Lucene search
+L

59 matches found

Kitploit
Kitploit
added 2026/09/22 3:53 p.m.16 views

velociraptor

Velociraptor - Endpoint visibility and collection tool. Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language VQL queries. To learn more about Velociraptor, read the documentation on: https://docs.velociraptor.app/ Quick start If you want to see...

5.8AI score
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/20 4:21 a.m.7 views

DetectRaptor

DetectRaptor A repository to share publicly available bulk Velociraptor detection content in an easy to consume way. Simply take the release VQL zip and import it into Velociraptor. This is made easy via the Velociraptor artifact exchange: Server.Import.DetectRaptor 1. Import Velociraptor Artifac...

5.9AI score
SaveExploits0References1
NVD
NVD
added 2026/09/10 3:17 a.m.10 views

CVE-2026-19584

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

7.7CVSS0.0019EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/10 3:00 a.m.11 views

EUVD-2026-75234

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

7.7CVSS5.7AI score0.0019EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/10 3:00 a.m.28 views

CVE-2026-19584

Velociraptor , a threat hunting and incident response platform, is affected by a VQL injection vulnerability in its notebook backup/restore feature. The daily backup mechanism is enabled by default; upon restore, notebook cell content is interpolated into a template without ACL checks . A user wi...

7.7CVSS5.7AI score0.0019EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/10 3:00 a.m.46 views

CVE-2026-19584 Velociraptor VQL injection during notebook restore from backup

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

7.7CVSS0.0019EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/10 3:00 a.m.23 views

CVE-2026-19584 Velociraptor VQL injection during notebook restore from backup

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

7.7CVSS5.8AI score
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/09/10 12:00 a.m.17 views

PT-2026-89260

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK EDITOR permission to plant a VQL...

7.7CVSS5.7AI score0.0019EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/24 4:16 a.m.20 views

CVE-2026-19200

The Velociraptor verify VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker...

8.9CVSS0.00228EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/24 3:22 a.m.32 views

CVE-2026-19200

Velociraptor 's verify() VQL function suffers from an implementation fault that causes it to use the global artifact repository instead of a scoped one. This allows a user with only the NOTEBOOK_EDIT permission (e.g., an analyst role) to overwrite existing live built-in artifacts without the perm...

8.9CVSS5.3AI score0.00228EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/24 3:22 a.m.14 views

CVE-2026-19200 Velociraptor Analyst overwrites live built-in artifacts through verify()

The Velociraptor verify VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker...

8.9CVSS5.6AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/24 3:22 a.m.71 views

CVE-2026-19200 Velociraptor Analyst overwrites live built-in artifacts through verify()

The Velociraptor verify VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker...

8.9CVSS0.00228EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/24 3:22 a.m.18 views

EUVD-2026-64703

The Velociraptor verify VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker...

8.9CVSS5.5AI score0.00228EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/12 9:44 a.m.46 views

CVE-2026-64952

Velociraptor’s hunt_delete() VQL function has a permission check flaw: it allows deleting hunts because the check requires COLLECT_CLIENT (investigator) instead of DELETE_RESULTS (administrators). This misapplies access control, potentially enabling non-administrator users to delete hunts. The CV...

6.5CVSS5.2AI score0.00174EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/12 9:44 a.m.16 views

EUVD-2026-57159

The huntdelete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECTCLIENT usually assigned to the "investigator" role instead of the "DELETERESULTS" permission usually only assigned to "administrators"...

6.5CVSS5.2AI score0.00174EPSS
SaveExploits0References1
attackerkb
attackerkb
added 2026/08/12 9:44 a.m.13 views

CVE-2026-64952

The huntdelete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECTCLIENT usually assigned to the "investigator" role instead of the "DELETERESULTS" permission usually only assigned to "administrators"...

6.5CVSS5.2AI score0.00174EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/12 5:19 a.m.11 views

CVE-2026-64954

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

8.2CVSS0.00232EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/12 4:26 a.m.54 views

CVE-2026-64954

Velociraptor vulnerability CVE-2026-64954 arises because the COLLECT_CLIENT permission is not enforced when a user can run a VQL query that resets the authorization provider. This lets a user who can execute arbitrary VQL (typically an analyst) trigger new collections that normally require the in...

8.2CVSS5.4AI score0.00232EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/12 4:26 a.m.42 views

CVE-2026-64954 Velociraptor collect_client() Permissions Bypass

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

8.2CVSS0.00232EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/12 4:26 a.m.10 views

CVE-2026-64954 Velociraptor collect_client() Permissions Bypass

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

8.2CVSS5.5AI score
SaveExploits0References5
Rows per page
Query Builder