https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T07:07:40.526186+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-18348 fkie_cve-2026-18348 2026-10-08T07:07:40.873383+00:00

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.

 https://vulnerability.circl.lu/vuln/ghsa-qx94-26r3-gv6g GHSA-qx94-26r3-gv6g 2026-10-08T07:07:40.873494+00:00

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.

 https://vulnerability.circl.lu/vuln/opensuse-su-2026:12070-1 openSUSE-SU-2026:12070-1 — velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media 2026-10-08T07:07:40.873526+00:00

velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media