GHSA-WG6Q-6289-32HP vulnerabilities

Vulnerabilities for packages: zipkin, apache-nifi-registry, logstash, apache-pulsar, jruby, kserve-modelmesh, keycloak, sonarqube, jenkins, thingsboard, druid, wildfly, apache-nifi...

CVE-2026-5588 vulnerabilities

Vulnerabilities for packages: zipkin, apache-nifi-registry, logstash, apache-pulsar, jruby, kserve-modelmesh, keycloak, sonarqube, jenkins, thingsboard, druid, wildfly, apache-nifi...

BIT-NIFI-2024-45477 Apache NiFi: Improper Neutralization of Input in Parameter Description

Apache NiFi 1.10.0 through 1.27.0 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will...

PT-2026-32513

Name of the Vulnerable Software and Affected Versions Apache NiFi affected versions not specified Description The TinkerpopClientService component of the Apache NiFi data processing platform contains access control errors. Specifically, it lacks the required Execute Code permission, which could...

GHSA-2M67-WJPJ-XHG9 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, flyway-fips, keycloak-config-cli, apicurio-registry, logstash, flyway, camunda-zeebe, camunda, sonarqube, apache-nifi, trino, logstash-fips, jenkins...

GHSA-2M67-WJPJ-XHG9 vulnerabilities

Vulnerabilities for packages: flyway, apache-nifi-registry, apicurio-registry, jenkins, keycloak-config-cli, trino, sonarqube, apache-nifi, logstash...

GHSA-8HFC-FQ58-R658 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry...

CVE-2026-22731 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry...

CVE-2026-22733 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry...

GHSA-MGVC-8Q2H-5PGC vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe, camunda...

CVE-2026-22733 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe, camunda...

CVE-2026-22731 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe, camunda...

GHSA-8HFC-FQ58-R658 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe, camunda...

CLEANSTART-2026-EI62818 Security fixes for ghsa-3677-xxcr-wjqv, ghsa-qqpg-mvqg-649v, ghsa-x44p-gvrj-pj2r applied in versions: 2.7.2-r0

Multiple security vulnerabilities affect the apache-nifi package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-22732 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, nacos-docker, nacos, kafbat-ui, thingsboard, camunda-zeebe, camunda, apache-nifi, kafbat-ui-fips, jenkins...

GHSA-MF92-479X-3373 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, nacos-docker, nacos, kafbat-ui, thingsboard, camunda-zeebe, camunda, apache-nifi, kafbat-ui-fips, jenkins...

GHSA-MF92-479X-3373 vulnerabilities

Vulnerabilities for packages: jenkins, apache-nifi, thingsboard, apache-nifi-registry...

CVE-2026-22732 vulnerabilities

Vulnerabilities for packages: jenkins, apache-nifi, thingsboard, apache-nifi-registry...

CVE-2025-59060

Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger versions = 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to the NiFiRegistryHostnameVerifier checking hostnames against subjectAltNames on any certificate in the TLS chain instead of verifying only the leaf/server certificate. An...