CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 02/10/2025 |
| CVE-2025-3019 | HOCH7.2 | KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java Script may be executed with this user's permissions. This can lead to information loss and/or modification of existing data.
The issues are | 31/03/2025 |
| CVE-2025-2402 | HOCH8.6 | A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the password to read and manipulate swapped jobs or read and manipulate in- and output data of active jobs. It is also possible to | 31/03/2025 |
| CVE-2025-2787 | HOCH8.8 | KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the worst case a complete takeover of the Kubernetes cluster is possible. Since the affected component is only reachable from within the cluster, i.e. requires an auth | 26/03/2025 |
| CVE-2024-6598 | MITTEL6.5 | A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This le | 09/07/2024 |
| CVE-2023-5562 | MITTEL6.1 | An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by default. If the data to | 12/10/2023 |
| CVE-2023-3140 | MITTEL4.3 | Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME
Business Hub before 1.4.0 has left users vulnerable to click
jacking. Clickjacking is an attack that occurs when an attacker uses a
transparent iframe in a window to trick a user into clicking on an
actionable item, such as a button or link, t | 07/06/2023 |
| CVE-2023-2541 | MITTEL5.3 | The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresses. No personal information or application data was exposed. | 07/06/2023 |
| CVE-2022-44749 | HOCH7.0 | A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being overwritten on the user's system. This vulnerability is also known as 'Zip-Slip'.
An attacker can create a KNIME workflow that, when being opened by a user, can | 24/11/2022 |
| CVE-2022-44748 | HOCH7.5 | A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'.
An attacker can create a KNIME workflow that, when being uploaded, can overwrite arbitr | 24/11/2022 |
| CVE-2022-31500 | HOCH7.8 | In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions. | 02/06/2022 |
| CVE-2021-45097 | MITTEL5.5 | KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users to read its content. | 16/12/2021 |
| CVE-2021-45096 | MITTEL4.3 | KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730. | 16/12/2021 |
| CVE-2021-44726 | MITTEL6.1 | KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. | 08/12/2021 |
| CVE-2021-44725 | HOCH7.5 | KNIME Server before 4.13.4 allows directory traversal in a request for a client profile. | 08/12/2021 |