Vulnerabilities

TI-2026-15285 CVE-2026-18652 · GHSA-9qrg-7832-x9w4

Velociraptor STACK Type Download Path Bypasses Denied Prefix Check

LOW 29

Velociraptor allows reading Stacked result sets from the GUI.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0034 Published 2026-08-12 Fixed in 0.77.2 CWE-862

TI-2026-46426 CVE-2026-64951 · GHSA-frg5-mq2m-h39j

Velociraptor DoS triggered by Divide by Zero panic

LOW 17

A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00281 Published 2026-08-12 Fixed in 0.77.2 CWE-369

TI-2026-46427 CVE-2026-64952 · GHSA-8f52-5rxc-fj43

Velociraptor Hunt Deletion With Insufficient Permission Check

LOW 29

The hunt_delete() VQL function allows deleting hunts.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00299 Published 2026-08-12 Fixed in 0.77.2 CWE-863

TI-2026-46429 CVE-2026-64955 · GHSA-x3cx-8mg8-hcv2

Velociraptor CSV Formula Injection in Export Pipeline

LOW 27

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00364 Published 2026-08-12 Fixed in 0.77.2 CWE-1236

TI-2026-46428 CVE-2026-64954 · GHSA-j6jv-j266-988h

Velociraptor collect_client() Permissions Bypass

LOW 37

Velociraptor allows scheduling new collections via VQL queries in notebooks.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.00308 Published 2026-08-12 Fixed in 0.77.2 CWE-862