Latest release is 0.76.5

Please note: Due to a GitHub sorting bug the 0.75 release is shown first, but the latest release is 0.76. The most reliable way to download the latest release is from the Download page or scroll below to see it.

I am very excited to announce that the latest Velociraptor release 0.75.3 is now available for download.

The full release notes are found here

If you find any issues please file an issue on GitHub or chat with us on our discord server.

Bugfixes in 0.75.2

• Bugfix: When using https clients would retry too quickly on 503 (#4461)
• Bugfix: Limit number of entries emitted into process_tracker_tree() (#4454)
• Bugfix: Uploading artifact pack was limited to 4mb (#4453)
• Bugfix: Windows.Forensics.Lnk had a bad performance bug (#4445)
• Bugfix: Initial notebooks for artifacts with no sources. (#4443)
• Bugfix: Layout of toolbars in the notebooks screen was messed up (#4439)
• Bugfix: Offline collector undefined fields should not be set (#4436)
• Bugfix: Single tag values to artifact_set_metadata() were ignored (#4429)

Bugfixes in 0.75.3

• Bugfix: Windows.Detection.Yara.PhysicalMemory was broken (#4499)
• Bugfix: Re-parse generated config file for GUI and offline command. (#4497)
• Added Windows.System.Threads artifact (#4496)
• Add sharphound artifact (#4492)
• Added yarax() plugin. (#4488)
• Bring back CreateTime so these can be used in timelines (#4486)
• Updated watch_syslog() to accept a query (#4480)
• Bugfix: Fix secrets enforcement logic (#4479)
• Bugfix: iops limit in throttler (#4474)
• Bugfix: Hunt flows table lost its flow link (#4469)
• Bugfix: Fix crash in resumable upload due to missing lock (#4465)
• Bugfix: Package creator did not set the run_as_user flag. (#4464)

Bugfixs in 0.75.4

• Bugfix: Backwards compatibility for watch_syslog() (#4504)

Bugfixes in 0.75.5

• Further performance optimizations (#4515)
• Bugfix: Reset all times when nanny detects a timeshift. (#4516)
• Bugfix: clear client selection when switching orgs. (#4519)
• More work on nanny. (#4522)
• Secrets can now be inherited from the root org (#4524)
• Bugfix: Allow upload_gcs() to use proxy configuration. (#4526)
• Bugfix: Update evtx parser to support non-english systems. (#4530)
• Bugfix: Deduplicate uploads by case insensitive name on windows. (#4533)
• Let the user know when critical errors happen via Global Messages (#4535)
• Bugfix: Set default theme to veloci-light (#4539)
• Added path_style option to upload_s3() (#4540)
• Fix table CSS when the table is empty. (#4545)
• Bugfix: Ensure client is created when a client id is provided (#4541)
• Bugfix: Added denied_file_accessor_prefix config option (#4548)
• Added a decrypt command to decrypt an encrypted container. (#4551)

Bugfixes in 0.75.6

• Address CVE-2025-14728
• Bugfix: Update Linux.Events.TrackProcesses to use HostPids
• Bugfix: GCS storage library did not load credentials. (#4598)
• Bugfix: Backwards compatibility for watch_syslog() (#4504)
• Improve sanitization of paths (#4593)
• Fix panic/error in zip accessor handling (#4589)
• fix: missing rpm release specification (#4587)
• Log audit information on the client. (#4585)
• Reworked client label button to separate removal action. (#4583)
• Support ADFS which gives the OIDC claims in the access token. (#4575)

NOTE

To address CVE 2026-5329 Please upgrade your server to 0.75.7