140 matches found
BIT-NIFI-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles
Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...
CLEANSTART-2026-YX18209 Security fix for CVE-2026-22745 applied in: activemq 5.19.8-r3, activemq 6.1.8-r1, activemq 6.2.3-r1, apache-hive 4.1.0-r5, apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, kafka-ui 1.4.2-r6, spring-boot 3.4.13-r3
CVE-2026-22745 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-FS83824 Security fix for CVE-2026-41851 applied in: activemq 5.19.8-r3, apache-hive 4.1.0-r5, apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3, rundeck 6.0.0-r0, spring-boot 3.4.13-r2
CVE-2026-41851 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-MK10000 Security fix for CVE-2026-41716 applied in: apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3
CVE-2026-41716 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-UH14817 Security fix for CVE-2026-41711 applied in: apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3
CVE-2026-41711 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-JD53485 Security fix for CVE-2026-41841 applied in: activemq 5.19.8-r3, apache-nifi-registry 2.9.0-r3, rundeck 6.0.0-r0
CVE-2026-41841 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-LH44323 Security fix for CVE-2026-41001 applied in: apache-nifi-registry 2.9.0-r3, rundeck 6.0.0-r0
CVE-2026-41001 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-CZ64223 Security fix for CVE-2026-40992 applied in: apache-nifi-registry 2.9.0-r3, rundeck 6.0.0-r0
CVE-2026-40992 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CVE-2026-87976
Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...
CVE-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles
Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...
CVE-2026-87976
Apache NiFi Registry versions 0.4.0 through 2.11.0 are vulnerable to path manipulation in the default file persistence provider. When storing extension bundle content, the provider used group, artifact, and version coordinates from uploaded NAR manifests as filesystem path components without reje...
CVE-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles
Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...
EUVD-2026-81075
Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...
CVE-2026-87976: Improper Limitation of a Pathname to a Restricted Directory
Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...
GHSA-GGG2-9786-HWC8 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe...
CVE-2026-41706 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry, geoserver...
GHSA-X2R2-RVHQ-2MQV vulnerabilities
Vulnerabilities for packages: apache-nifi-registry, geoserver...
GHSA-88FW-V6X4-3F58 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry...