https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 08:39:00 +0000 https://cve.radiocsirt.org/vuln/cve-2026-18635 <p><strong>Affected:</strong> Rapid7 Velociraptor</p> <p>Velociraptor&#39;s VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller&#39;s org instead of against the target org.</p> <p>This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.</p> <p><strong>Affected:</strong> Rapid7 Velociraptor</p> <p>Velociraptor&#39;s VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller&#39;s org instead of against the target org.</p> <p>This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.</p> https://cve.radiocsirt.org/vuln/cve-2026-18635