Skip to main content
cve.nowby Sazabi
← Go
GoPackage

www.velocidex.com/golang/velociraptor

7 known vulnerabilities (2 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 high, 5 medium
Registry
pkg.go.dev

Advisories 7

  • CVE-2026-6863Medium 6.8

    HTTP Filestore Endpoints Misapply Permissions Across Organizations

    Affected: fixed in 0.76.4.

  • CVE-2026-7572Medium 4.4

    Velociraptor EVTX Parser — Process Crash via Crafted .evtx File

    Affected: all versions; fixed in 0.76.5.

  • CVE-2026-7573Medium 5.0

    GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations

    Affected: fixed in 0.76.5; all versions.

  • Velociraptor Query() Plugin Misapplies Permissions To Orgs

    Affected: all versions; through 0.76.2.

  • CVE-2025-6264Medium 5.5

    Velociraptor priviledge escalation via UpdateConfig artifact

    Affected: fixed in 0.74.3.

  • CVE-2023-0290Medium 4.3

    Rapid7 Velociraptor directory traversal in client ID parameter

    Affected: fixed in 0.6.7-5.

  • Insufficient permission check in the VQL copy() function

    Affected: fixed in 0.6.7-5.