security@knime.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS security@knime.com
03
assessed vulnerabilities (21)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-115657US | — | — | ||
When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An a… | ||||
| CVE-2026-115519US | — | — | ||
Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security… | ||||
| CVE-2026-115517US | — | — | ||
Unrestricted network access between execution contexts in KNIME Business Hub before version 1.19.0 allows an authenticated remote user to access open network ports on executors in… | ||||
| CVE-2026-115516US | — | — | ||
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-115502US | —OT elevated | — | ||
A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNI… | ||||
| CVE-2026-115496US | — | — | ||
Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if the… | ||||
| CVE-2026-115494US | — | — | ||
A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user… | ||||
| CVE-2026-115454US | — | — | ||
An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources… | ||||
| CVE-2026-4649US | —OT elevated | — | ||
Apache Artemis before version 2.52.0 is affected by an authentication bypass flaw which allows reading all messages exchanged via the broker and injection of new message ( CVE-2026… | ||||
| CVE-2025-14262US | medium4.3 | — | ||
A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker… | ||||
| CVE-2025-11240US | high7.2 | — | ||
An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNIME Business Hub insta… | ||||
| CVE-2025-11239US | medium4.3OT elevated | — | ||
Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hub 1.16.0 only metadat… | ||||
| CVE-2025-3019US | high7.2 | — | ||
KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java… | ||||
| CVE-2025-2402US | high8.6OT elevated | — | ||
A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in posse… | ||||
| CVE-2025-2787US | high8.8 | — | ||
KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the worst case a complete t… | ||||
| CVE-2024-6598US | medium6.5 | — | ||
A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privilege… | ||||
| CVE-2023-5562US | medium6.1 | — | ||
An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either K… | ||||
| CVE-2023-3140US | medium4.3 | — | ||
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME
Business Hub before 1.4.0 has left users vulnerable to click
jacking. Clickjacking is an attack that occu… | ||||
| CVE-2023-2541US | medium5.3 | — | ||
The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresse… | ||||
| CVE-2022-44749US | high7.0 | — | ||
A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being overwritten on the user's… | ||||