Export limit exceeded: 375213 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (375213 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18860 | 1 Rapid7 | 1 Velociraptor | 2026-08-11 | 8.7 High |
| Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org. This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs. | ||||
| CVE-2026-17535 | 2026-08-11 | 6.2 Medium | ||
| Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However, in some applications (e.g. dead disk forensics https://docs.velociraptor.app/docs/forensic/deaddisk/ ) Velociraptor may be used on untrusted NTFS image files. If an attacker is able to inject maliciously corrupted NTFS Volumes they can cause a crash and a Denial of Service. | ||||
| CVE-2026-18636 | 2026-08-11 | 6.8 Medium | ||
| The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission. | ||||
| CVE-2020-37265 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2020-37264 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2020-37263 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2020-37262 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2020-37261 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2020-37260 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2020-37259 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2020-37258 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2020-37257 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2023-54374 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2023-54373 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2023-54372 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2023-54371 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2023-54370 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2023-54369 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2023-54368 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2023-54367 | 2026-08-11 | N/A | ||
| This CVE ID has been rejected. | ||||