CVE-2026-115454

MediumCVSS 5.3/10Last modified Oct 22, 2026

Description

An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources on the server side. This leads to intermittent unavailability of workflow execution functionality. A workaround is not possible.

Metrics

CVSS 4.0 5.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:Green

Weakness enumeration

CWE-770

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 22, 2026
Last modified: Oct 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1154577.1baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the CVE-2026-115469.8IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adm CVE-2026-1154777.1obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP dep CVE-2026-1154787.1obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_en CVE-2026-1154795.3baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a CVE-2026-115484.8IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a CVE-2026-1154805.3baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_CVE-2026-1154818.5baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService CVE-2026-1154827.5In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not li CVE-2026-1154847.6A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, ca CVE-2026-1154856.3A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL CVE-2026-1154867.1A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed