velociraptor

Velociraptor - Endpoint visibility and collection tool. Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language VQL queries. To learn more about Velociraptor, read the documentation on: https://docs.velociraptor.app/ Quick start If you want to see...

DetectRaptor

DetectRaptor A repository to share publicly available bulk Velociraptor detection content in an easy to consume way. Simply take the release VQL zip and import it into Velociraptor. This is made easy via the Velociraptor artifact exchange: Server.Import.DetectRaptor 1. Import Velociraptor Artifac...

SUSE CVE-2026-19072

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-19072

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

EUVD-2026-85870

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-19072 Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-19072

The Velociraptor platform is vulnerable to a security bypass because it allows users to set the internal "compiled_collector_args" field via a user API call. This flaw allows a user with the minimal "investigator" role to inject compiled VQL statements for a hunt while bypassing standard ACL chec...

CVE-2026-19072 Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-19072 Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

PT-2026-97792

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description Velociraptor stores compiled VQL Velociraptor Query Language within the hunt object to prevent redundant recompilation for every endpoint. A flaw exists where the internal field compiled...

CVE-2026-19072: Product Released in Non-Release Configuration

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

SUSE CVE-2026-19584

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

CVE-2026-19584

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

CVE-2026-19584 Velociraptor VQL injection during notebook restore from backup

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

EUVD-2026-75234

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

CVE-2026-19584 Velociraptor VQL injection during notebook restore from backup

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

CVE-2026-19584 Velociraptor VQL injection during notebook restore from backup

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

CVE-2026-19584

Velociraptor , a threat hunting and incident response platform, is affected by a VQL injection vulnerability in its notebook backup/restore feature. The daily backup mechanism is enabled by default; upon restore, notebook cell content is interpolated into a template without ACL checks . A user wi...

PT-2026-89260

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK EDITOR permission to plant a VQL...

CVE-2026-19584: Improper Neutralization of Special Elements Used in a Template Engine

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...