CVE-2026-64954 Velociraptor collect_client() Permissions Bypass

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

Trivum Multiroom Setup Tool 8.76 Cross Site Request Forgery

Exploit Title: Trivum Multiroom Setup Tool 8.76 - Corss-Site Request Forgery Admin Bypass Date: 2018-07-25 Software Link: https://world.trivum-shop.de https://world.trivum-shop.de/ Version: 9.34 build 13381 - 12.07.18 Category: hardware, webapps Tested on: V8.76 - SNR 8604.26 - C4 Professional...