Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 4.8 | CVE-2026-115657 |
When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup
Apache, KNIMEApache Tomcat, KNIME Business Hub, KNIME Analytics Platform, KNIME Server, Apache Artemis
|
NVD | |||
|
CVE-2026-115657When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup
Executive summaryThis advisory page from KNIME covers many security issues across KNIME Analytics Platform, KNIME Server, and KNIME Business Hub, including the newest entries published in October 2026 and many older ones. The most recent items include credential logging in KNIME Analytics Platform used as an executor (CVSS v4.0 4.8, Medium) and several Medium issues in KNIME Business Hub, which the vendor says are fixed in version 1.19.0. The vendor recommends updating to the fixed versions listed for each issue. Technical summaryThe advisory lists many issues with different classes, including credential logging, missing cookie attributes, missing authorization checks, CSRF protection bypass via a forged X-Forwarded-Host header, excessive resource allocation, open redirect, and cross-site scripting. For CVE-2026-115657, KNIME Analytics Platform before 5.8.4 and 5.12.0 logs configured proxy credentials at startup when used as an executor, and an attacker with access to log files could reuse them; the advisory says there is no risk without an authenticated proxy, and fixed versions are LTS 5.8.4 and 5.12.0. For the KNIME Business Hub items, the fixed version is 1.19.0 for most CVEs, with workarounds stated for some (such as network policies or removing links without login) and not possible for others. For CVE-2026-4649, the advisory states Apache Artemis is affected, the fix is in Business Hub 1.18.0, 1.17.4, 1.16.3, and 1.15.2, and no workaround is known. Where the advisory does not state a workaround or detection guidance, this is not stated. Detection guidance is not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Summarized from knime.com/security/advisories Impact if exploitedConfidentialityNone IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsApacheKNIMEApache TomcatKNIME Business HubKNIME Analytics PlatformKNIME ServerApache Artemis
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||