{"affected":[{"defaultStatus":"unaffected","product":"KNIME Business Hub","source":"CNA: KNIME","vendor":"KNIME","versions":[{"lessThan":"1.19.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.19.0","versionType":"semver"}]}],"cveId":"CVE-2026-115519","cwes":["CWE-614","CWE-1004"],"description":"Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.","epss":{"date":"2026-11-01","percentile":0.08251,"score":0.00186},"exploits":[],"kev":null,"metrics":[{"score":2.1,"severity":"low","source":"CNA: KNIME","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793621386844,"publishedAt":1792693113751,"references":[{"source":"CNA: KNIME","tags":[],"url":"https://www.knime.com/security/advisories"}],"remediation":[],"revision":"cf5bfbcfef70755323adfc882e22eda7763b66e5a5b41653041eca66150f6b89","sources":[{"modifiedAt":1793621386844,"name":"CNA: KNIME","retrievedAt":1793624926963,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115519"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793624952380,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115519"}],"ssvc":{"assessedAt":1793621369127,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub","updatedAt":1793624952380}