CVE-2026-4649 | | | 2026-03-24 | Apache Artemis before version 2.52.0 is affected by an authentication bypass flaw which allows reading all messages exchanged via the broker and injection of n… |
CVE-2025-14262 | Medium | 4.3 | 2025-12-08 | A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the jo… |
CVE-2025-11240 | High | 7.2 | 2025-10-02 | An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNI… |
CVE-2025-11239 | Medium | 4.3 | 2025-10-02 | Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hu… |
CVE-2025-3019 | High | 7.2 | 2025-03-31 | KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web… |
CVE-2025-2402 | High | 8.6 | 2025-03-31 | A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated rem… |
CVE-2025-2787 | High | 8.8 | 2025-03-26 | KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the wo… |
CVE-2024-6598 | Medium | 6.5 | 2024-07-09 | A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with jo… |
CVE-2023-5562 | Medium | 6.1 | 2023-10-12 | An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an… |
CVE-2023-3140 | Medium | 4.3 | 2023-06-07 | Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME
Business Hub before 1.4.0 has left users vulnerable to click
jacking. Clickjacking i… |
CVE-2023-2541 | Medium | 5.3 | 2023-06-07 | The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host… |
CVE-2022-44749 | Medium | 5.5 | 2022-11-24 | A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being over… |
CVE-2022-44748 | High | 7.1 | 2022-11-24 | A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the s… |
CVE-2022-31500 | High | 7.8 | 2022-06-02 | In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions. |
CVE-2021-45097 | Low | 2.9 | 2021-12-16 | KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file a… |
CVE-2021-45096 | Medium | 4.7 | 2021-12-16 | KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730. |
CVE-2021-44726 | High | 8.8 | 2021-12-08 | KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. |
CVE-2021-44725 | High | 7.5 | 2021-12-08 | KNIME Server before 4.13.4 allows directory traversal in a request for a client profile. |