velociraptor vulnerabilities (openSUSE)
125 vulnerabilities.
velociraptoropenSUSESVGO: removeScripts allows executable links through namespace and control-character bypasses8.2 HighvelociraptoropenSUSESVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements6.1 MediumvelociraptoropenSUSEVelociraptor DoS triggered by Divide by Zero panic3.5 LowvelociraptoropenSUSEVelociraptor Hunt Deletion With Insufficient Permission Check6.5 MediumvelociraptoropenSUSEVelociraptor collect_client() Permissions Bypass8.2 HighvelociraptoropenSUSEVelociraptor OIDC Authenticator susceptible to email spoofing7.3 HighvelociraptoropenSUSEVelociraptor server crash via the SetPassword API6.5 MediumvelociraptoropenSUSEVelociraptor incorrect Org deletion permissions check8.7 HighvelociraptoropenSUSEVelociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes6.2 MediumvelociraptoropenSUSEVelociraptor VFSGetBuffer API path deny list bypass6.8 MediumvelociraptoropenSUSEVelociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins4.1 MediumvelociraptoropenSUSEPostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure7.5 HighvelociraptoropenSUSEbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation7.5 HighvelociraptoropenSUSEnanoid: Integer Overflow or Wraparound7.4 HighvelociraptoropenSUSEPostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset6.3 MediumvelociraptoropenSUSEPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments7.5 HighvelociraptoropenSUSEbrace-expansion DoS via unbounded expansion length causing an out-of-memory process crash7.5 HighvelociraptoropenSUSESVGO: removeScripts plugin leaves some executable scripts intact8.2 HighvelociraptoropenSUSEaxios before 0.33.0 Prototype Pollution via Node HTTP adapter8.3 HighvelociraptoropenSUSEaxios before 1.18.0 Prototype Pollution via auth subfields6.3 MediumvelociraptoropenSUSEInfinite loop on invalid input in golang.org/x/text7.5 HighvelociraptoropenSUSEjs-yaml: YAML merge-key chains can force quadratic CPU consumption7.5 HighvelociraptoropenSUSEjs-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases5.3 MediumvelociraptoropenSUSEBabel: Arbitrary File Read via sourceMappingURL Comment in @babel/core3.2 LowvelociraptoropenSUSEform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)8.7 HighvelociraptoropenSUSEInvoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html6.1 MediumvelociraptoropenSUSEInvoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html6.1 MediumvelociraptoropenSUSEInvoking duplicate attributes can cause XSS in golang.org/x/net/html6.1 MediumvelociraptoropenSUSEInvoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html6.1 MediumvelociraptoropenSUSEInvoking denial of service when parsing arbitrary HTML in golang.org/x/net/html6.5 MediumvelociraptoropenSUSEInvoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent5.3 MediumvelociraptoropenSUSEInvoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh7.5 HighvelociraptoropenSUSEInvoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh10.0 CriticalvelociraptoropenSUSEInvoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts9.1 CriticalvelociraptoropenSUSEInvoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh5.3 MediumvelociraptoropenSUSEInvoking infinite loop on large channel writes in golang.org/x/crypto/ssh9.1 CriticalvelociraptoropenSUSEInvoking key constraints not enforced in golang.org/x/crypto/ssh/agent9.1 CriticalvelociraptoropenSUSEInvoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent9.1 CriticalvelociraptoropenSUSEInvoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh9.1 CriticalvelociraptoropenSUSEInvoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh9.1 CriticalvelociraptoropenSUSEInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh7.5 HighvelociraptoropenSUSEInvoking bypass of certificate restrictions in golang.org/x/crypto/ssh6.3 MediumvelociraptoropenSUSEInvoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh6.5 MediumvelociraptoropenSUSEInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net7.5 HighvelociraptoropenSUSEHTTP Filestore Endpoints Misapply Permissions Across Organizations6.8 MediumvelociraptoropenSUSEVelociraptor EVTX Parser — Process Crash via Crafted .evtx File4.4 MediumvelociraptoropenSUSEGetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations5.0 MediumvelociraptoropenSUSEUnbounded Memory Allocation in VQLResponse Result-Set Writer4.9 MediumvelociraptoropenSUSEAxios: unbounded recursion in toFormData causes DoS via deeply nested request data6.9 MediumvelociraptoropenSUSEfast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters6.1 Medium- Show olderLoading…