[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-19583":6},{"stargazers_count":4,"fetched_at":5},7,"2026-09-10T04:22:39.150Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":548,"aliases":549,"duplicate_of":9,"upstream":550,"downstream":551,"duplicates":552,"related":553,"reserved_at":9,"published_at":554,"modified_at":554,"state":555,"summary":556,"references_raw":563,"kevs":575,"epss":9,"epss_history":576,"metrics":577,"affected":585},"CVE-2026-19583","Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts (such as Linux.Sys.BashShell).",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-732","Incorrect Permission Assignment for Critical Resource","The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.","weakness","Draft","Class","High",[20,68,222,256,298,320,333,337,498,502,506],{"id":21,"name":22,"techniques":23},"CAPEC-1","Accessing Functionality Not Properly Constrained by ACLs",[24],{"id":25,"name":26,"tactics":27,"countermeasures":43},"T1574.010","Services File Permissions Weakness",[28,31,34,37,40],{"id":29,"name":30},"TA0110","Persistence",{"id":32,"name":33},"TA0111","Privilege Escalation",{"id":35,"name":36},"TA0030","Defense Evasion",{"id":38,"name":39},"TA0005","Stealth",{"id":41,"name":42},"TA0104","Execution",[44,49,54,59,63],{"id":45,"name":46,"tactic":47},"D3-RS","Restore Software",{"name":48},"Restore",{"id":50,"name":51,"tactic":52},"D3-SWI","Software Inventory",{"name":53},"Model",{"id":55,"name":56,"tactic":57},"D3-SBV","Service Binary Verification",{"name":58},"Detect",{"id":60,"name":61,"tactic":62},"D3-AVE","Asset Vulnerability Enumeration",{"name":53},{"id":64,"name":65,"tactic":66},"D3-SU","Software Update",{"name":67},"Harden",{"id":69,"name":70,"techniques":71},"CAPEC-122","Privilege Abuse",[72],{"id":73,"name":74,"tactics":75,"countermeasures":78},"T1548","Abuse Elevation Control Mechanism",[76,77],{"id":35,"name":36},{"id":32,"name":33},[79,83,87,91,95,99,103,107,111,115,119,123,127,131,136,140,145,149,153,157,162,166,170,174,178,182,186,190,194,198,202,206,210,214,218],{"id":80,"name":81,"tactic":82},"D3-AM","Access Modeling",{"name":53},{"id":84,"name":85,"tactic":86},"D3-CI","Configuration Inventory",{"name":53},{"id":88,"name":89,"tactic":90},"D3-DI","Data Inventory",{"name":53},{"id":92,"name":93,"tactic":94},"D3-NTPM","Network Traffic Policy Mapping",{"name":53},{"id":96,"name":97,"tactic":98},"D3-AEM","Application Exception Monitoring",{"name":58},{"id":100,"name":101,"tactic":102},"D3-SCA","System Call Analysis",{"name":58},{"id":104,"name":105,"tactic":106},"D3-SFA","System File Analysis",{"name":58},{"id":108,"name":109,"tactic":110},"D3-FA","File Analysis",{"name":58},{"id":112,"name":113,"tactic":114},"D3-FIM","File Integrity Monitoring",{"name":58},{"id":116,"name":117,"tactic":118},"D3-OPM","Operational Process Monitoring",{"name":58},{"id":120,"name":121,"tactic":122},"D3-DA","Dynamic Analysis",{"name":58},{"id":124,"name":125,"tactic":126},"D3-EFA","Emulated File Analysis",{"name":58},{"id":128,"name":129,"tactic":130},"D3-PSA","Process Spawn Analysis",{"name":58},{"id":132,"name":133,"tactic":134},"D3-FEV","File Eviction",{"name":135},"Evict",{"id":137,"name":138,"tactic":139},"D3-AL","Account Locking",{"name":135},{"id":141,"name":142,"tactic":143},"D3-DF","Decoy File",{"name":144},"Deceive",{"id":146,"name":147,"tactic":148},"D3-FE","File Encryption",{"name":67},{"id":150,"name":151,"tactic":152},"D3-AA","Agent Authentication",{"name":67},{"id":154,"name":155,"tactic":156},"D3-CDP","Change Default Password",{"name":67},{"id":158,"name":159,"tactic":160},"D3-HBPI","Hardware-based Process Isolation",{"name":161},"Isolate",{"id":163,"name":164,"tactic":165},"D3-SCP","System Configuration Permissions",{"name":67},{"id":167,"name":168,"tactic":169},"D3-RC","Restore Configuration",{"name":48},{"id":171,"name":172,"tactic":173},"D3-RF","Restore File",{"name":48},{"id":175,"name":176,"tactic":177},"D3-ULA","Unlock Account",{"name":48},{"id":179,"name":180,"tactic":181},"D3-RUAA","Restore User Account Access",{"name":48},{"id":183,"name":184,"tactic":185},"D3-RD","Restore Database",{"name":48},{"id":187,"name":188,"tactic":189},"D3-SCF","System Call Filtering",{"name":161},{"id":191,"name":192,"tactic":193},"D3-CF","Content Filtering",{"name":161},{"id":195,"name":196,"tactic":197},"D3-LFP","Local File Permissions",{"name":161},{"id":199,"name":200,"tactic":201},"D3-RFAM","Remote File Access Mediation",{"name":161},{"id":203,"name":204,"tactic":205},"D3-CQ","Content Quarantine",{"name":161},{"id":207,"name":208,"tactic":209},"D3-CM","Content Modification",{"name":161},{"id":211,"name":212,"tactic":213},"D3-UAP","User Account Permissions",{"name":161},{"id":215,"name":216,"tactic":217},"D3-EAL","Executable Allowlisting",{"name":161},{"id":219,"name":220,"tactic":221},"D3-EDL","Executable Denylisting",{"name":161},{"id":223,"name":224,"techniques":225},"CAPEC-127","Directory Indexing",[226],{"id":227,"name":228,"tactics":229,"countermeasures":233},"T1083","File and Directory Discovery",[230],{"id":231,"name":232},"TA0102","Discovery",[234,236,238,240,242,244,246,248,250,252,254],{"id":203,"name":204,"tactic":235},{"name":161},{"id":146,"name":147,"tactic":237},{"name":67},{"id":141,"name":142,"tactic":239},{"name":144},{"id":108,"name":109,"tactic":241},{"name":58},{"id":112,"name":113,"tactic":243},{"name":58},{"id":195,"name":196,"tactic":245},{"name":161},{"id":191,"name":192,"tactic":247},{"name":161},{"id":199,"name":200,"tactic":249},{"name":161},{"id":171,"name":172,"tactic":251},{"name":48},{"id":207,"name":208,"tactic":253},{"name":161},{"id":132,"name":133,"tactic":255},{"name":135},{"id":257,"name":258,"techniques":259},"CAPEC-17","Using Malicious Files",[260,280],{"id":261,"name":262,"tactics":263,"countermeasures":269},"T1574.005","Executable Installer File Permissions Weakness",[264,265,266,267,268],{"id":29,"name":30},{"id":32,"name":33},{"id":35,"name":36},{"id":38,"name":39},{"id":41,"name":42},[270,272,274,276,278],{"id":64,"name":65,"tactic":271},{"name":67},{"id":45,"name":46,"tactic":273},{"name":48},{"id":60,"name":61,"tactic":275},{"name":53},{"id":50,"name":51,"tactic":277},{"name":53},{"id":55,"name":56,"tactic":279},{"name":58},{"id":25,"name":26,"tactics":281,"countermeasures":287},[282,283,284,285,286],{"id":29,"name":30},{"id":32,"name":33},{"id":35,"name":36},{"id":38,"name":39},{"id":41,"name":42},[288,290,292,294,296],{"id":45,"name":46,"tactic":289},{"name":48},{"id":50,"name":51,"tactic":291},{"name":53},{"id":55,"name":56,"tactic":293},{"name":58},{"id":60,"name":61,"tactic":295},{"name":53},{"id":64,"name":65,"tactic":297},{"name":67},{"id":299,"name":300,"techniques":301},"CAPEC-180","Exploiting Incorrectly Configured Access Control Security Levels",[302],{"id":25,"name":26,"tactics":303,"countermeasures":309},[304,305,306,307,308],{"id":29,"name":30},{"id":32,"name":33},{"id":35,"name":36},{"id":38,"name":39},{"id":41,"name":42},[310,312,314,316,318],{"id":45,"name":46,"tactic":311},{"name":48},{"id":50,"name":51,"tactic":313},{"name":53},{"id":55,"name":56,"tactic":315},{"name":58},{"id":60,"name":61,"tactic":317},{"name":53},{"id":64,"name":65,"tactic":319},{"name":67},{"id":321,"name":322,"techniques":323},"CAPEC-206","Signing Malicious Code",[324],{"id":325,"name":326,"tactics":327,"countermeasures":332},"T1553.002","Code Signing",[328,329],{"id":35,"name":36},{"id":330,"name":331},"TA0112","Defense Impairment",[],{"id":334,"name":335,"techniques":336},"CAPEC-234","Hijacking a privileged process",[],{"id":338,"name":339,"techniques":340},"CAPEC-60","Reusing Session IDs (aka Session Replay)",[341,393],{"id":342,"name":343,"tactics":344,"countermeasures":348},"T1134.001","Token Impersonation/Theft",[345,346,347],{"id":35,"name":36},{"id":38,"name":39},{"id":32,"name":33},[349,353,357,361,365,369,373,377,381,385,389],{"id":350,"name":351,"tactic":352},"D3-CR","Credential Revocation",{"name":135},{"id":354,"name":355,"tactic":356},"D3-CCSA","Credential Compromise Scope Analysis",{"name":58},{"id":358,"name":359,"tactic":360},"D3-CTS","Credential Transmission Scoping",{"name":161},{"id":362,"name":363,"tactic":364},"D3-ANCI","Authentication Cache Invalidation",{"name":135},{"id":366,"name":367,"tactic":368},"D3-TB","Token Binding",{"name":67},{"id":370,"name":371,"tactic":372},"D3-TBA","Token-based Authentication",{"name":67},{"id":374,"name":375,"tactic":376},"D3-DUC","Decoy User Credential",{"name":144},{"id":378,"name":379,"tactic":380},"D3-CH","Credential Hardening",{"name":67},{"id":382,"name":383,"tactic":384},"D3-CRO","Credential Rotation",{"name":67},{"id":386,"name":387,"tactic":388},"D3-MFA","Multi-factor Authentication",{"name":67},{"id":390,"name":391,"tactic":392},"D3-RIC","Reissue Credential",{"name":48},{"id":394,"name":395,"tactics":396,"countermeasures":401},"T1550.004","Web Session Cookie",[397,398],{"id":35,"name":36},{"id":399,"name":400},"TA0109","Lateral Movement",[402,404,406,408,410,414,418,422,426,428,430,434,438,442,446,448,452,454,458,460,464,468,470,472,476,480,484,486,490,494],{"id":382,"name":383,"tactic":403},{"name":67},{"id":187,"name":188,"tactic":405},{"name":161},{"id":390,"name":391,"tactic":407},{"name":48},{"id":358,"name":359,"tactic":409},{"name":161},{"id":411,"name":412,"tactic":413},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":58},{"id":415,"name":416,"tactic":417},"D3-APCA","Application Protocol Command Analysis",{"name":58},{"id":419,"name":420,"tactic":421},"D3-PSMD","Process Self-Modification Detection",{"name":58},{"id":423,"name":424,"tactic":425},"D3-RTSD","Remote Terminal Session Detection",{"name":58},{"id":128,"name":129,"tactic":427},{"name":58},{"id":158,"name":159,"tactic":429},{"name":161},{"id":431,"name":432,"tactic":433},"D3-KBPI","Kernel-based Process Isolation",{"name":161},{"id":435,"name":436,"tactic":437},"D3-ABPI","Application-based Process Isolation",{"name":161},{"id":439,"name":440,"tactic":441},"D3-HS","Host Shutdown",{"name":135},{"id":443,"name":444,"tactic":445},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":58},{"id":350,"name":351,"tactic":447},{"name":135},{"id":449,"name":450,"tactic":451},"D3-HR","Host Reboot",{"name":135},{"id":354,"name":355,"tactic":453},{"name":58},{"id":455,"name":456,"tactic":457},"D3-NTF","Network Traffic Filtering",{"name":161},{"id":374,"name":375,"tactic":459},{"name":144},{"id":461,"name":462,"tactic":463},"D3-CSPP","Client-server Payload Profiling",{"name":58},{"id":465,"name":466,"tactic":467},"D3-PT","Process Termination",{"name":135},{"id":378,"name":379,"tactic":469},{"name":67},{"id":386,"name":387,"tactic":471},{"name":67},{"id":473,"name":474,"tactic":475},"D3-PLA","Process Lineage Analysis",{"name":58},{"id":477,"name":478,"tactic":479},"D3-NTCD","Network Traffic Community Deviation",{"name":58},{"id":481,"name":482,"tactic":483},"D3-PS","Process Suspension",{"name":135},{"id":362,"name":363,"tactic":485},{"name":135},{"id":487,"name":488,"tactic":489},"D3-NTSA","Network Traffic Signature Analysis",{"name":58},{"id":491,"name":492,"tactic":493},"D3-WSAM","Web Session Access Mediation",{"name":161},{"id":495,"name":496,"tactic":497},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":58},{"id":499,"name":500,"techniques":501},"CAPEC-61","Session Fixation",[],{"id":503,"name":504,"techniques":505},"CAPEC-62","Cross Site Request Forgery",[],{"id":507,"name":508,"techniques":509},"CAPEC-642","Replace Binaries",[510,516,530],{"id":511,"name":512,"tactics":513,"countermeasures":515},"T1505.005","Terminal Services DLL",[514],{"id":29,"name":30},[],{"id":517,"name":518,"tactics":519,"countermeasures":521},"T1554","Compromise Host Software Binary",[520],{"id":29,"name":30},[522,524,526,528],{"id":64,"name":65,"tactic":523},{"name":67},{"id":60,"name":61,"tactic":525},{"name":53},{"id":45,"name":46,"tactic":527},{"name":48},{"id":50,"name":51,"tactic":529},{"name":53},{"id":261,"name":262,"tactics":531,"countermeasures":537},[532,533,534,535,536],{"id":29,"name":30},{"id":32,"name":33},{"id":35,"name":36},{"id":38,"name":39},{"id":41,"name":42},[538,540,542,544,546],{"id":64,"name":65,"tactic":539},{"name":67},{"id":45,"name":46,"tactic":541},{"name":48},{"id":60,"name":61,"tactic":543},{"name":53},{"id":50,"name":51,"tactic":545},{"name":53},{"id":55,"name":56,"tactic":547},{"name":58},[],[],[],[],[],[],"2026-09-10T02:58:11.751Z","Received",{"cisa_kev":557,"cisa_ransomware":557,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":558,"severity_score":559,"severity_version":560,"severity_source":561,"severity_vector":562,"severity_status":555},false,"critical",9.9,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",[564,570],{"url":565,"sources":566,"tags":568},"http://docs.velociraptor.app/announcements/advisories/cve-2026-19583/",[561,567],"nvd",[569],"Vendor Advisory",{"url":571,"sources":572,"tags":573},"https://github.com/Velocidex/velociraptor/pull/4967",[561,567],[574],"Patch",[],[],[578,583],{"source":561,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":579,"cvss_v4_0":9},{"baseScore":559,"baseSeverity":580,"vectorString":562,"impactScore":581,"exploitabilityScore":582},"CRITICAL",10,7.9,{"source":567,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":584,"cvss_v4_0":9},{"baseScore":559,"baseSeverity":580,"vectorString":562,"impactScore":581,"exploitabilityScore":582},[586],{"ecosystem":9,"name":587,"vendor":588,"product":589,"cpe_part":590,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":591},"Velociraptor","rapid7","velociraptor","a",[592],{"version":593,"is_range":594,"range_type":561,"version_start":9,"version_start_type":9,"version_end":595,"version_end_type":596,"fixed_in":9},"\u003C 0.77.2",true,"0.77.2","excluding"]