Known Vulnerabilities for Velociraptor by Velocidex
Listed below are 6 of the newest known vulnerabilities associated with "Velociraptor" by "Velocidex".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-18860 json | Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create ... | Not Provided | 2026-08-11 | 2026-08-11 |
| CVE-2026-18636 json | The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from re... | Not Provided | 2026-08-11 | 2026-08-11 |
| CVE-2026-18635 json | Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to ru... | Not Provided | 2026-08-11 | 2026-08-11 |
| CVE-2026-18348 json | Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role... | Not Provided | 2026-08-11 | 2026-08-11 |
| CVE-2026-17535 json | Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by mali... | Not Provided | 2026-08-11 | 2026-08-11 |
| CVE-2026-8795 json | A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76... | Not Provided | 2026-06-09 | 2026-06-10 |