KNIME records

17 published records for vendor knime.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 64.7%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

17 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2025-2402No exploit	Hard-coded password for object store of KNIME Business Hubknime · business hub · CWE-259 Pre-auth Hard-coded credentials	High8.8	—	0.3%	Mar 31, 2025
34Monitor	CVE-2025-2787No exploit	Ingress-nginx vulnerability in KNIME Business Hubknime · business hub · CWE-94 RCE	High8.7	—	0.4%	Mar 26, 2025
31Monitor	CVE-2022-31500No exploit	In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions.knime · knime analytics platform · CWE-276	High7.8	—	0.2%	Jun 2, 2022
30Monitor	CVE-2021-44725No exploit	KNIME Server before 4.13.4 allows directory traversal in a request for a client profile.knime · knime server · CWE-22 Pre-auth Path traversal	High7.5	—	1.5%	Dec 8, 2021
30Monitor	CVE-2022-44748No exploit	Uploading workflows to KNIME Server may override arbitrary file system contentsknime · knime server · CWE-22 RCE Path traversal	High7.5	—	1.4%	Nov 24, 2022
28Monitor	CVE-2024-6598No exploit	Denial-of-service on KNIME Business Hub when certain jobs are executedknime · business hub · CWE-770 Denial of service	High7.1	—	0.5%	Jul 9, 2024
28Monitor	CVE-2022-44749No exploit	Opening workflows from untrusted resources may override arbitrary file system contentsknime · knime analytics platform · CWE-22 RCE Path traversal	High7.0	—	0.4%	Nov 24, 2022
24Monitor	CVE-2021-44726No exploit	KNIME Server before 4.13.4 allows XSS via the old WebPortal login page.knime · knime server · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Dec 8, 2021
24Monitor	CVE-2023-5562No exploit	Unsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business Hubknime · knime analytics platform · CWE-79 Pre-auth XSS	Medium6.1	—	0.3%	Oct 12, 2023
22Monitor	CVE-2021-45097No exploit	KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file withoutknime · knime server · CWE-522 Info leak	Medium5.5	—	0.2%	Dec 16, 2021
21Monitor	CVE-2023-2541No exploit	Sensitive information disclosure in KNIME Hub Web Applicationknime · business hub · CWE-497 Pre-auth Info leak	Medium5.3	—	0.6%	Jun 7, 2023
21Monitor	CVE-2025-3019No exploit	Cross-site scripting vulnerabilities in KNIME Business Hub web pagesknime · business hub · CWE-79 Pre-auth XSS	Medium5.3	—	0.2%	Mar 31, 2025
21Monitor	CVE-2025-11240No exploit	Open redirect vulnerability in KNIME Business Hubknime · business hub · CWE-601 Pre-auth Open redirect	Medium5.3	—	0.2%	Oct 2, 2025
21Monitor	CVE-2025-14262No exploit	Jobs can be saved as workflows with wrong permissions on KNIME Business Hubknime · business hub · CWE-708	Medium5.3	—	0.1%	Dec 8, 2025
17Monitor	CVE-2021-45096No exploit	KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730knime · knime analytics platform · CWE-611 Pre-auth XXE	Medium4.3	—	1.1%	Dec 16, 2021
17Monitor	CVE-2023-3140No exploit	KNIME Hub Web Application is vulnerable to clickjackingknime · business hub · CWE-1021 Pre-auth	Medium4.3	—	0.4%	Jun 7, 2023
9Monitor	CVE-2025-11239No exploit	Job details are visible to all team members on KNIME Business Hubknime · business hub · CWE-863 Broken access control (IDOR)	Low2.3	—	0.2%	Oct 2, 2025

CVE-2025-2402
35Monitor
Hard-coded password for object store of KNIME Business Hub
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
knime · business hubMar 31, 2025
CVE-2025-2787
34Monitor
Ingress-nginx vulnerability in KNIME Business Hub
HighCVSS 8.7No exploitEPSS 0%
- RCE
knime · business hubMar 26, 2025
CVE-2022-31500
31Monitor
In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions.
HighCVSS 7.8No exploitEPSS 0%
knime · knime analytics platformJun 2, 2022
CVE-2021-44725
30Monitor
KNIME Server before 4.13.4 allows directory traversal in a request for a client profile.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Path traversal
knime · knime serverDec 8, 2021
CVE-2022-44748
30Monitor
Uploading workflows to KNIME Server may override arbitrary file system contents
HighCVSS 7.5No exploitEPSS 1%
- RCE
- Path traversal
knime · knime serverNov 24, 2022
CVE-2024-6598
28Monitor
Denial-of-service on KNIME Business Hub when certain jobs are executed
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
knime · business hubJul 9, 2024
CVE-2022-44749
28Monitor
Opening workflows from untrusted resources may override arbitrary file system contents
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Path traversal
knime · knime analytics platformNov 24, 2022
CVE-2021-44726
24Monitor
KNIME Server before 4.13.4 allows XSS via the old WebPortal login page.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
knime · knime serverDec 8, 2021
CVE-2023-5562
24Monitor
Unsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business Hub
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
knime · knime analytics platformOct 12, 2023
CVE-2021-45097
22Monitor
KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without
MediumCVSS 5.5No exploitEPSS 0%
- Info leak
knime · knime serverDec 16, 2021
CVE-2023-2541
21Monitor
Sensitive information disclosure in KNIME Hub Web Application
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Info leak
knime · business hubJun 7, 2023
CVE-2025-3019
21Monitor
Cross-site scripting vulnerabilities in KNIME Business Hub web pages
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- XSS
knime · business hubMar 31, 2025
CVE-2025-11240
21Monitor
Open redirect vulnerability in KNIME Business Hub
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Open redirect
knime · business hubOct 2, 2025
CVE-2025-14262
21Monitor
Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
MediumCVSS 5.3No exploitEPSS 0%
knime · business hubDec 8, 2025
CVE-2021-45096
17Monitor
KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730
MediumCVSS 4.3No exploitEPSS 1%
- Pre-auth
- XXE
knime · knime analytics platformDec 16, 2021
CVE-2023-3140
17Monitor
KNIME Hub Web Application is vulnerable to clickjacking
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
knime · business hubJun 7, 2023
CVE-2025-11239
9Monitor
Job details are visible to all team members on KNIME Business Hub
LowCVSS 2.3No exploitEPSS 0%
- Broken access control (IDOR)
knime · business hubOct 2, 2025