# Apache Nifi


- [CVE-2018-1309](https://insights.sbomify.com/CVE-2018-1309/): Improper Restriction of XML External Entity Reference in Apache NiFi (critical 9.8)
- [CVE-2017-15697](https://insights.sbomify.com/CVE-2017-15697/): Apache NiFi XSS issue in context path handling (critical 9.8)
- [CVE-2017-5636](https://insights.sbomify.com/CVE-2017-5636/): Injection in Apache NiFi (critical 9.8)
- [CVE-2026-68981](https://insights.sbomify.com/CVE-2026-68981/): Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests (high 8.8)
- [CVE-2023-36542](https://insights.sbomify.com/CVE-2023-36542/): Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources (high 8.8)
- [CVE-2023-34468](https://insights.sbomify.com/CVE-2023-34468/): Apache NiFi: Potential Code Injection with Database Services using H2 (high 8.8)
- [CVE-2022-33140](https://insights.sbomify.com/CVE-2022-33140/): Improper Neutralization of Command Elements in Shell User Group Provider (high 8.8)
- [CVE-2019-12421](https://insights.sbomify.com/CVE-2019-12421/): Apache NiFi user log out issue (high 8.8)
- [CVE-2026-25903](https://insights.sbomify.com/CVE-2026-25903/): Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates (high 8.7)
- [CVE-2021-20190](https://insights.sbomify.com/CVE-2021-20190/): Deserialization of untrusted data in jackson-databind (high 8.1)
- [CVE-2023-49145](https://insights.sbomify.com/CVE-2023-49145/): Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt (high 7.9)
- [CVE-2026-62354](https://insights.sbomify.com/CVE-2026-62354/): Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests (high 7.7)

---
From sbomify Insights: https://insights.sbomify.com/products/apache/nifi/