VE
Product
Velociraptor
42
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 4High 11Medium 25Low 2
Watch
Add Velociraptor to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-19200 | 8.9 | Aug 24 | Velociraptor Analyst overwrites live built-in artifacts through verify() Affected: before 0.77.2 |
| CVE-2023-0242 | 8.8 | Jan 18 | Rapid7 Velociraptor allows users to be created with different privileges on the server Affected: before 0.6.7-5 |
| CVE-2026-18860 | 8.7 | Aug 11 | Velociraptor incorrect Org deletion permissions check Affected: before 0.77.2 |
| CVE-2026-64954 | 8.2 | Aug 12 | Velociraptor collect_client() Permissions Bypass Affected: before 0.77.2 |
| CVE-2026-15371 | 8.1 | Aug 18 | Velociraptor Stored XSS in URL column types Affected: before 0.77.2 |
| CVE-2026-8795 | 7.8 | Jun 9 | A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6 Affected: before 0.76.6 |
| CVE-2026-19584 | 7.7 | Sep 10 | Velociraptor VQL injection during notebook restore from backup Affected: before 0.77.2 |
| CVE-2026-7573 | 7.7 | May 6 | GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations Affected: before 0.76.5 |
| CVE-2026-18639 | 7.3 | Aug 11 | Velociraptor OIDC Authenticator susceptible to email spoofing Affected: before 0.77.2 |
| CVE-2026-18635 | 7.2 | Aug 11 | Velociraptor query plugin allows impersonation in other orgs Affected: before 0.77.2 |
| CVE-2026-18640 | 7.1 | Aug 11 | Velociraptor directory traversal via the NewNotebook API Affected: before 0.77.2 |
Showing 11