KNIME

Records26All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

KNIME records in CISA KEV

No KNIME vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Business Hub 9 records MEDIUM Knime Analytics Platform 4 records LOW Knime Server 4 records LOW

Records

9 records in Business Hub · all components

TI-2025-02116 CVE-2025-2402 · GHSA-v5p7-3387-gpmg

Hard-coded password for object store of KNIME Business Hub

MEDIUM 44

A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the password to read and manipu…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00393 Published 2025-03-31 Fixed in 1.13.2, 1.12.3 +2 CWE-259

TI-2025-02436 CVE-2025-2787 · GHSA-x237-489c-52j2

Ingress-nginx vulnerability in KNIME Business Hub

MEDIUM 40

KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00499 Published 2025-03-26 No fix listed CWE-94

TI-2024-06119 CVE-2024-6598 · GHSA-p36m-8r3w-rq6p

Denial-of-service on KNIME Business Hub when certain jobs are executed

LOW 32

A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0054 Published 2024-07-09 Fixed in 1.10.2 CWE-770

TI-2025-02634 CVE-2025-3019 · GHSA-4c3m-33r2-8r8w

Cross-site scripting vulnerabilities in KNIME Business Hub web pages

LOW 30

KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00272 Published 2025-03-31 Fixed in 1.13.3, 1.12.4 CWE-79

TI-2023-02376 CVE-2023-2541 · GHSA-hg34-pjxc-5j77

Sensitive information disclosure in KNIME Hub Web Application

LOW 25

The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresses.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00642 Published 2023-06-07 Fixed in 1.4.0 CWE-497

TI-2025-10293 CVE-2025-11240 · GHSA-82rh-xw3j-936r

Open redirect vulnerability in KNIME Business Hub

LOW 24

An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00255 Published 2025-10-02 Fixed in 1.16.0 CWE-601

TI-2025-13035 CVE-2025-14262 · GHSA-mcx7-55c8-m5jv

Jobs can be saved as workflows with wrong permissions on KNIME Business Hub

LOW 23

A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00194 Published 2025-12-08 Fixed in 1.17.0 CWE-708

TI-2023-02942 CVE-2023-3140 · GHSA-vhh4-6mxg-jm86

KNIME Hub Web Application is vulnerable to clickjacking

LOW 20

Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00402 Published 2023-06-07 Fixed in 1.4.0 CWE-1021

TI-2025-10292 CVE-2025-11239 · GHSA-967v-9xqg-gjxg

Job details are visible to all team members on KNIME Business Hub

LOW 11

Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00211 Published 2025-10-02 Fixed in 1.16.0 CWE-863

Open these records in search →

Critical	0
High	8
Medium	16
Low	2
No CVSS	0