CVE-2026-78413

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...

seekr

A multi-purpose toolkit for gathering and managing OSINT-Data with a neat web-interface. Introduction Seekr is a multi-purpose toolkit for gathering and managing OSINT-data with a sleek web interface. Our desktop view enables you to have all of your favourite OSINT tools integrated in one. The...

CVE-2026-78413 Velociraptor privilege escalation via SysmonLogForward client monitoring artifact

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...

EUVD-2026-92536

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...

CVE-2026-78413

The Velociraptor platform is vulnerable to a privilege escalation issue involving the Windows.Sysinternals.SysmonLogForward monitoring artifact. The root cause is Incorrect Default Permissions (CWE-276), as the artifact allows users to specify an arbitrary binary path but fails to enforce additio...

ogi-transforms

Registro de Transformaciones OGI Transformaciones comunitarias para OGI, una herramienta OSINT y de análisis de enlaces de código abierto. Cómo funciona Cada directorio bajo transforms/ es una transformación instalable de forma independiente. La CLI de OGI y la interfaz de Transform Hub leen...

ogi-transforms

OGI Transform Registry Community transforms for OGI, an open source OSINT and link analysis tool. How it works Each directory under transforms/ is an independently installable transform. The OGI CLI and Transform Hub UI read index.json auto-generated on each merge to discover what's available...

RpcInvestigator

RPC Investigator Lea nuestro anuncio del blog. RPC Investigator RPCI es una aplicación de interfaz de usuario de Windows Forms en .NET/C que ofrece una interfaz avanzada de descubrimiento y análisis para puntos finales RPC de Windows. La herramienta proporciona una interfaz visual alrededor de la...

mig

MIG: Mozilla InvestiGator MIG es la plataforma de Mozilla para la investigación quirúrgica de endpoints remotos. ⚠️ Aviso de desuso ⚠️ Mozilla ya no mantiene el proyecto Mozilla InvestiGator MIG. Mozilla tampoco utiliza este código internamente. Eres bienvenido a usar este código tal cual, sin...

SUSE CVE-2026-19072

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-19072 Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-19072 Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-19072 Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

EUVD-2026-85870

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-19072

The Velociraptor platform is vulnerable to a security bypass because it allows users to set the internal "compiled_collector_args" field via a user API call. This flaw allows a user with the minimal "investigator" role to inject compiled VQL statements for a hunt while bypassing standard ACL chec...

CVE-2026-19072: Product Released in Non-Release Configuration

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

PT-2026-97792

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description Velociraptor stores compiled VQL Velociraptor Query Language within the hunt object to prevent redundant recompilation for every endpoint. A flaw exists where the internal field compiled...

CVE-2026-64952 Velociraptor Hunt Deletion With Insufficient Permission Check

The huntdelete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECTCLIENT usually assigned to the "investigator" role instead of the "DELETERESULTS" permission usually only assigned to "administrators"...

CVE-2026-64952 Velociraptor Hunt Deletion With Insufficient Permission Check

The huntdelete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECTCLIENT usually assigned to the "investigator" role instead of the "DELETERESULTS" permission usually only assigned to "administrators"...

CVE-2026-64954

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...