CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 02/10/2025 |
| CVE-2025-3019 | 高危7.2 | KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java Script may be executed with this user's permissions. This can lead to information loss and/or modification of existing data.
The issues are | 31/03/2025 |
| CVE-2025-2402 | 高危8.6 | A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the password to read and manipulate swapped jobs or read and manipulate in- and output data of active jobs. It is also possible to | 31/03/2025 |
| CVE-2025-2787 | 高危8.8 | KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the worst case a complete takeover of the Kubernetes cluster is possible. Since the affected component is only reachable from within the cluster, i.e. requires an auth | 26/03/2025 |
| CVE-2024-6598 | 中危6.5 | A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This le | 09/07/2024 |
| CVE-2023-5562 | 中危6.1 | An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by default. If the data to | 12/10/2023 |
| CVE-2023-3140 | 中危4.3 | Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME
Business Hub before 1.4.0 has left users vulnerable to click
jacking. Clickjacking is an attack that occurs when an attacker uses a
transparent iframe in a window to trick a user into clicking on an
actionable item, such as a button or link, t | 07/06/2023 |
| CVE-2023-2541 | 中危5.3 | The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresses. No personal information or application data was exposed. | 07/06/2023 |
| CVE-2022-44749 | 高危7.0 | A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being overwritten on the user's system. This vulnerability is also known as 'Zip-Slip'.
An attacker can create a KNIME workflow that, when being opened by a user, can | 24/11/2022 |
| CVE-2022-44748 | 高危7.5 | A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'.
An attacker can create a KNIME workflow that, when being uploaded, can overwrite arbitr | 24/11/2022 |
| CVE-2022-31500 | 高危7.8 | In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions. | 02/06/2022 |
| CVE-2021-45097 | 中危5.5 | KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users to read its content. | 16/12/2021 |
| CVE-2021-45096 | 中危4.3 | KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730. | 16/12/2021 |
| CVE-2021-44726 | 中危6.1 | KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. | 08/12/2021 |
| CVE-2021-44725 | 高危7.5 | KNIME Server before 4.13.4 allows directory traversal in a request for a client profile. | 08/12/2021 |