Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Nov 20, 2025Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.CVE-2025-61138 · Other software · Qlik · reported by MITREHigh 7.5
Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.
- Product
- Qlik Sense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2024An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR.CVE-2024-55580 · Other software · reported by MITREHigh 7.5
An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. Unprivileged users with network access may be able to execute remote commands that could cause high availability damages, including high integrity and confidentiality risks. This is fixed in November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2024An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR.CVE-2024-55579 · Other software · reported by MITREHigh 8.8
An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network access may be able to create connection objects that trigger execution of arbitrary EXE files. This is fixed in November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2024Qlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper validation.CVE-2024-36077 · Other software · qlik · reported by MITREHigh 8.8
Qlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper validation. The attacker can elevate their privilege to the internal system role, which allows them to execute commands on the server. This affects February 2024 Patch 3 (14.173.3 through 14.173.7), November 2023 Patch 8 (14.159.4 through 14.159.13), August 2023 Patch 13 (14.139.3 through 14.139.20), May 2023 Patch 15 (14.129.3 through 14.129.22), February 2023 Patch 13 (14.113.1 through 14.113.18), November 2022 Patch 13 (14.97.2 through 14.97.18), August 2022 Patch 16 (14.78.3 through 14.78.23), and May 2022 Patch 17 (14.67.7 through 14.67.31). This has been fixed in May 2024 (14.187.4), February 2024 Patch 4 (14.173.8), November 2023 Patch 9 (14.159.14), August 2023 Patch 14 (14.139.21), May 2023 Patch 16 (14.129.23), February 2023 Patch 14 (14.113.19), November 2022 Patch 14 (14.97.19), August 2022 Patch 17 (14.78.25), and May 2022 Patch 18 (14.67.34).
- Product
- qlik_sense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.qlik.comcommunity.qlik.com
Nov 15, 2023Qlik Sense HTTP Tunneling VulnerabilityCVE-2023-48365 · Other software · Qlik · reported by MITREExploitedRansomwareCritical 9.6
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
- Product
- Sense
- On CISA’s list since
- Jan 13, 2025 (federal fix deadline Feb 3, 2025)
- What to do
- Attackers are using this now. Install Qlik’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcommunity.qlik.comcommunity.qlik.com
Aug 29, 2023Qlik Sense Path Traversal VulnerabilityCVE-2023-41266 · Other software · Qlik · reported by MITREExploitedRansomwareHigh 8.2
Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.
- Product
- Sense
- On CISA’s list since
- Dec 7, 2023 (federal fix deadline Dec 28, 2023)
- What to do
- Attackers are using this now. Install Qlik’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcommunity.qlik.comcommunity.qlik.com
Aug 29, 2023Qlik Sense HTTP Tunneling VulnerabilityCVE-2023-41265 · Other software · Qlik · reported by MITREExploitedRansomwareCritical 9.6
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
- Product
- Sense
- On CISA’s list since
- Dec 7, 2023 (federal fix deadline Dec 28, 2023)
- What to do
- Attackers are using this now. Install Qlik’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcommunity.qlik.comcommunity.qlik.com
Jun 21, 2022The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.CVE-2021-36761 · Other software · Qlik · reported by MITREMedium 5.3
The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
- Product
- Qlik Sense
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberiskvision.comcyberiskvision.com
Feb 21, 2022A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts.CVE-2022-0564 · Other software · Qlik Sense · reported by csirt@divd.nlMedium 5.3
A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured. The affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists.
- Product
- Qlik Sense Enterprise on Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.qlik.comcsirt.divd.nl
Apr 30, 2019An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense EnterpriCVE-2019-11628 · Other software · Qlik · reported by MITREHigh 8.2
An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.
- Product
- Qlikview Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqliksupport.force.comqliksupport.force.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.