868 matches found
CVE-2026-56740 vulnerabilities
Vulnerabilities for packages: apache-pulsar, zookeeper, druid, kafka, tez, apache-nifi, confluent-kafka...
CVE-2026-56741 vulnerabilities
Vulnerabilities for packages: apache-pulsar, zookeeper, druid, kafka, tez, apache-nifi, confluent-kafka...
CVE-2026-47065 vulnerabilities
Vulnerabilities for packages: apache-nifi, guacamole-client, hadoop-fips, jenkins...
GHSA-V3PR-HXPR-MFM8 vulnerabilities
Vulnerabilities for packages: apache-nifi, guacamole-client, hadoop-fips, jenkins...
CVE-2026-47065 vulnerabilities
Vulnerabilities for packages: apache-nifi, jenkins...
GHSA-V3PR-HXPR-MFM8 vulnerabilities
Vulnerabilities for packages: apache-nifi, jenkins...
Exploit for Code Injection in Apache Nifi
CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC...
BIT-NIFI-2026-54665 Apache NiFi: Missing Validation for Proxy Host Headers
Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in...
BIT-NIFI-2026-44911 Apache NiFi: Incorrect Authorization for Configuration Verification Requests
Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined...
Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL
Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not...
Apache NiFi fails to validate proxy host headers when constructing qualified URLs
Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in...
GHSA-R2G5-993Q-664G Apache NiFi: Missing authorization when replacing Process Groups with restricted components
Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not...
GHSA-8VM2-C32J-MVFR Apache NiFi fails to validate proxy host headers when constructing qualified URLs
Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in...
GHSA-CHXJ-GXWW-Q98W Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL
Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not...
Apache NiFi: Missing authorization when replacing Process Groups with restricted components
Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not...
Apache NiFi allows read-only users to submit component configuration verification request
Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined...
GHSA-QVJ8-GWPM-4X49 Apache NiFi allows read-only users to submit component configuration verification request
Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined...
CVE-2026-54665
Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in...
CVE-2026-44911
Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined...
CVE-2026-44913
Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not...