CVE-2026-115519Low· 2.1▾ SunlitMissing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 11.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.
business_hub < 1.19.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115494Medium· 5.3CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub
CVE-2026-115454Medium· 5.3Large tables in data apps can bring down execution services in KNIME Hub
CVE-2026-115496Medium· 6.9Workflow names may be leaked to unauthenticated users in KNIME Business Hub
CVE-2026-115502Medium· 6.3DataApp links without login expose job information to other user in KNIME Business Hub
CVE-2026-115517Medium· 6.4Unrestricted network access between execution contexts in KNIME Business Hub
CVE-2026-115657Medium· 4.8KNIME Analytics Platform logs credentials of configured proxy when used as an executor