Product by Rapid7

    Rapid7 Velociraptor

    45 known vulnerabilities in Rapid7 Velociraptor (Rapid7), 0 of them actively exploited (CISA KEV).

    Key figures

    45

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Rapid7 Velociraptor (Rapid7)
    CriticalCVE-2026-19583

    Velociraptor Required Permissions bypass by using client monitoring queries

    		9.9
    CriticalCVE-2026-19072

    Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

    		9.9
    HighCVE-2026-18860

    Velociraptor incorrect Org deletion permissions check

    		8.7
    CriticalCVE-2026-18972

    Velociraptor authenticated identity-spoofing vulnerability

    		9.6
    HighCVE-2026-19200

    Velociraptor Analyst overwrites live built-in artifacts through verify()

    		8.9
    HighCVE-2026-18635

    Velociraptor query plugin allows impersonation in other orgs

    		7.2
    HighCVE-2026-15371

    Velociraptor Stored XSS in URL column types

    		8.1
    HighCVE-2026-18640

    Velociraptor directory traversal via the NewNotebook API

    		7.1
    HighCVE-2026-19584

    Velociraptor VQL injection during notebook restore from backup

    		7.7
    MediumCVE-2025-6264

    Velociraptor priviledge escalation via UpdateConfig artifact

    also in 1 other product

    		5.5
    HighCVE-2026-64954

    Velociraptor collect_client() Permissions Bypass

    		8.2
    HighCVE-2026-18639

    Velociraptor OIDC Authenticator susceptible to email spoofing

    		7.3
    MediumCVE-2026-18636

    Velociraptor VFSGetBuffer API path deny list bypass

    		6.8
    MediumCVE-2026-18638

    Velociraptor server crash via the SetPassword API

    		6.5
    HighCVE-2026-64953

    Rapid7 Velociraptor: security vulnerability

    		—
    MediumCVE-2025-14728

    Rapid7 Velociraptor Directory Traversal Vulnerability

    		6.8
    CriticalCVE-2026-6290

    Velociraptor Query() Plugin Misapplies Permissions To Orgs

    also in 1 other product

    		9.1
    MediumCVE-2026-78411

    Velociraptor Server Metadata update with Insufficient Permission Check

    		6.5
    HighCVE-2023-0242

    Insufficient permission check in the VQL copy() function

    also in 1 other product

    		8.8
    MediumCVE-2026-77798

    Velociraptor Authenticated Denial of Service

    		6.5
    MediumCVE-2026-18652

    Velociraptor STACK Type Download Path Bypasses Denied Prefix Check

    		6.5
    HighCVE-2026-5329

    Rapid7 Velociraptor Improper Input Validation in Client Message Handler

    		6.5
    MediumCVE-2026-64955

    Velociraptor CSV Formula Injection in Export Pipeline

    		6.1
    MediumCVE-2026-64952

    Velociraptor Hunt Deletion With Insufficient Permission Check

    		6.5
    HighCVE-2023-5950

    Rapid7 Velociraptor Reflected XSS

    		8.6

    All vulnerabilities in search

    News

    All products by Rapid7