https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:41:18.602381+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-186185 EUVD-2026-186185 2026-10-03T03:41:18.673821+00:00 EUVD-2026-186185 https://cve.radiocsirt.org/vuln/fkie_cve-2023-5562 fkie_cve-2023-5562 2026-10-03T03:41:18.673857+00:00

An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by default. If the data to be displayed contains JavaScript this code is executed in the browser and can perform any operations that the current user is allowed to perform silently.

KNIME Analytics Platform already has configuration options with which sanitization of data can be actived, see https://docs.knime.com/latest/webportal_admin_guide/index.html#html-sanitization-webportal https://docs.knime.com/latest/webportal_admin_guide/index.html#html-sanitization-webportal . However, these are off by default which allows for cross-site scripting attacks.

KNIME Analytics Platform 5.2.0 will enable sanitization by default. For all previous releases we recommend users to add the corresponding settings to the executor's knime.ini.

 https://cve.radiocsirt.org/vuln/ghsa-4g9c-4jmr-xrqp GHSA-4g9c-4jmr-xrqp 2026-10-03T03:41:18.673897+00:00

An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by default. If the data to be displayed contains JavaScript this code is executed in the browser and can perform any operations that the current user is allowed to perform silently.

KNIME Analytics Platform already has configuration options with which sanitization of data can be actived, see https://docs.knime.com/latest/webportal_admin_guide/index.html#html-sanitization-webportal https://docs.knime.com/latest/webportal_admin_guide/index.html#html-sanitization-webportal . However, these are off by default which allows for cross-site scripting attacks.

KNIME Analytics Platform 5.2.0 will enable sanitization by default. For all previous releases we recommend users to add the corresponding settings to the executor's knime.ini.

 https://cve.radiocsirt.org/vuln/gsd-2023-5562 gsd-2023-5562 2026-10-03T03:41:18.673922+00:00 gsd-2023-5562 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2641 WID-SEC-W-2023-2641 — KNIME Analytics Platform: Schwachstelle ermöglicht Cross-Site Scripting 2026-10-03T03:41:18.673934+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in KNIME Analytics Platform ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.