Knowage

This hub aggregates every CVE we track for Knowage. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Knowage.

• CVE-2025-58441Knowage is vulnerable to blind server-side request forgery (SSRF)6.5Jan 7, 2026
• CVE-2025-59954Knowage Contains a Remote Code Execution Vulnerability9.8Sep 29, 2025
• CVE-2025-55007Knowage vulnerable to server-side request forgery3.5Sep 1, 2025
• CVE-2024-57971DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name.9.1Feb 16, 2025
• CVE-2023-38702Knowage Server vulnerable to path traversal via upload functionality9.9Aug 4, 2023
• CVE-2023-37472Query injection in Knowage server7.7Jul 14, 2023
• CVE-2023-36819Knowage-Server vulnerable to Path traversal in download functionalities6.5Jul 3, 2023
• CVE-2023-35154Knowage-Server vulnerable to account validation bypass7.2Jun 23, 2023
• CVE-2022-39295Improper Neutralization of Alternate XSS Syntax in Knowage-Server6.1Oct 13, 2022
• CVE-2021-30213Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter.6.1May 12, 2021
• CVE-2021-30214Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter.5.4May 12, 2021
• CVE-2021-30212Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter.5.4May 12, 2021
• CVE-2021-30211Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter.5.4May 12, 2021
• CVE-2021-30055A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report.8.8Apr 5, 2021
• CVE-2021-30056Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead ...5.4Apr 5, 2021