{"id":"CVE-2026-115519","aliases":[],"cve":{"records":[{"id":"CVE-2026-115519","source":"KNIME","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-22T18:10:43.317Z","published":"2026-10-22T18:18:33.751Z","modified":"2026-11-02T12:09:46.844Z"}],"publishers":[{"name":"KNIME","role":"CNA","organizationId":"296541fb-a0e3-4ca7-ab3d-683e666d143e","modified":"2026-10-22T18:18:33.751Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-02T12:09:46.844Z"}],"references":[{"url":"https://www.knime.com/security/advisories","tags":[],"source":"KNIME"}],"weaknesses":[{"id":"CWE-614","description":"CWE-614 Sensitive cookie in HTTPS session without 'secure' attribute","source":"KNIME"},{"id":"CWE-1004","description":"CWE-1004 Sensitive cookie without 'HttpOnly' flag","source":"KNIME"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-02T12:09:29.127000Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub","titleSource":"KNIME","descriptionSource":"KNIME","description":"Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.","score":2.1,"severity":"low","published":"2026-10-22T18:18:33.751Z","modified":"2026-11-02T12:09:46.844Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"KNIME","name":"KNIME Business Hub","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.19.0","versionType":"semver"},{"version":"1.19.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"KNIME","url":"https://www.cve.org/CVERecord?id=CVE-2026-115519"}],"remediation":[],"references":["https://www.knime.com/security/advisories"],"sources":[{"name":"CVE","id":"CVE-2026-115519","modified":"2026-11-02T12:09:46.844Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-115519"}],"assessments":[{"source":"KNIME","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.1}],"sourceAffected":[],"observedAt":"2026-11-02T12:30:51.078Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:55:32.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-02T13:15:33.877Z","attemptedAt":"2026-11-02T13:15:33.877Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-02T13:15:34.245Z","attemptedAt":"2026-11-02T13:15:34.245Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-02T13:15:34.543Z","attemptedAt":"2026-11-02T13:15:34.543Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-02T13:15:33.858Z","attemptedAt":"2026-11-02T13:15:33.858Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-115519","url":"https://www.first.org/epss/","probability":0.00186,"percentile":0.08251,"date":"2026-11-01","checkedAt":"2026-11-02T13:15:33.858Z"},{"source":"NVD","id":"CVE-2026-115519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115519","modified":"2026-10-23T19:43:46.190","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-02T13:15:33.877Z"},{"source":"GitHub Advisory Database","id":"GHSA-p7r5-wmfj-6x3r","url":"https://github.com/advisories/GHSA-p7r5-wmfj-6x3r","modified":"2026-10-22T21:32:46Z","checkedAt":"2026-11-02T13:15:34.245Z"},{"source":"ENISA EUVD","id":"EUVD-2026-108279","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108279","modified":"Oct 22, 2026, 6:18:33 PM","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-02T13:15:34.543Z"}],"aiSummary":{"text":"KNIME Business Hub versions before 1.19.0 have sensitive cookies without 'Secure' and 'HttpOnly' attributes, allowing an unauthenticated remote attacker to compromise user sessions if other security issues are present. The product is vulnerable due to missing security attributes on sensitive cookies. An attacker needs other security issues to be present to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-02T12:31:05.336Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-115519"}]}}