Rapid7
92 CVEs across 47 Rapid7 products. Browse Rapid7 vulnerabilities, severities, and proof-of-concept exploits.
Rapid7 products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64955 | Medium | 6.1 | 2026-08-12 | When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velocira… |
CVE-2026-64952 | Medium | 6.5 | 2026-08-12 | The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "in… |
CVE-2026-64951 | Low | 3.5 | 2026-08-12 | A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server proc… |
CVE-2026-18652 | Medium | 4.9 | 2026-08-12 | Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requ… |
CVE-2026-64954 | High | 8.2 | 2026-08-12 | Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permissio… |
CVE-2026-18640 | High | 7.1 | 2026-08-11 | The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record out… |
CVE-2026-18639 | High | 7.3 | 2026-08-11 | When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email… |
CVE-2026-18638 | Medium | 6.5 | 2026-08-11 | Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling Set… |
CVE-2026-18860 | High | 8.7 | 2026-08-11 | Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants withi… |
CVE-2026-18636 | Medium | 6.8 | 2026-08-11 | The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing… |
CVE-2026-18635 | High | 7.2 | 2026-08-11 | Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling… |
CVE-2026-17535 | Medium | 6.2 | 2026-08-11 | Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typi… |
CVE-2026-18972 | Critical | 9.6 | 2026-08-11 | An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an acc… |
CVE-2026-18348 | Medium | 4.1 | 2026-08-11 | Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-contro… |
CVE-2026-14172 | High | 7.8 | 2026-07-24 | Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a l… |
CVE-2026-8661 | Medium | 4.8 | 2026-06-26 | Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers… |
CVE-2026-8662 | Low | 3.3 | 2026-06-25 | Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to uni… |
CVE-2026-8658 | Medium | 6.0 | 2026-06-25 | OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the opt… |
CVE-2026-8666 | High | 7.7 | 2026-06-25 | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS… |
CVE-2026-8665 | High | 7.7 | 2026-06-25 | OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands… |
CVE-2026-8664 | Medium | 6.0 | 2026-06-25 | OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the user… |
CVE-2026-8660 | High | 7.7 | 2026-06-25 | OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands vi… |
CVE-2026-8592 | High | 7.7 | 2026-06-25 | OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS co… |
CVE-2026-9155 | High | 8.8 | 2026-06-25 | OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the express… |
CVE-2026-9154 | High | 7.1 | 2026-06-25 | Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitrar… |
CVE-2026-9153 | Medium | 6.5 | 2026-06-25 | Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read arbitrary files via the expression parame… |
CVE-2026-8663 | Medium | 6.0 | 2026-06-25 | OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the repo, k… |
CVE-2026-8659 | Medium | 6.0 | 2026-06-25 | OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the api_… |
CVE-2026-8795 | High | 7.8 | 2026-06-09 | A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in client_i… |
CVE-2026-7373 | | 2026-05-15 | Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the… | |
CVE-2026-6863 | Medium | 6.8 | 2026-05-06 | Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organizat… |
CVE-2026-7573 | Medium | 5.0 | 2026-05-06 | An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege u… |
CVE-2026-7572 | Medium | 4.4 | 2026-05-06 | An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux a… |
CVE-2026-6948 | Medium | 4.9 | 2026-05-04 | Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel. This allows a compromised or rogue… |
CVE-2026-6482 | High | 7.8 | 2026-04-17 | The Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of a Windows… |
CVE-2026-6290 | High | 8.0 | 2026-04-15 | Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This all… |
CVE-2026-4482 | Medium | 5.5 | 2026-04-10 | The installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read and execute… |
CVE-2026-5329 | High | 8.5 | 2026-04-09 | Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor se… |
CVE-2026-4837 | Medium | 6.6 | 2026-04-08 | An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code e… |
CVE-2026-1568 | Critical | 9.6 | 2026-02-03 | Rapid7 InsightVM versions before 8.34.0 contain a signature verification issue on the Assertion Consumer Service (ACS) cloud endpoint that could allow an attac… |
CVE-2026-1814 | | 2026-02-03 | Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. Wh… | |
CVE-2025-14728 | Medium | 6.8 | 2025-12-29 | Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written ou… |
CVE-2025-11195 | Low | 3.3 | 2025-09-30 | Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in th… |
CVE-2025-36857 | Low | 3.3 | 2025-09-25 | Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, where… |
CVE-2025-6264 | Medium | 5.5 | 2025-06-20 | Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated… |
CVE-2025-4951 | Medium | 4.6 | 2025-05-20 | Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field. Despite the appli… |
CVE-2025-0914 | Low | 3.8 | 2025-02-27 | An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4 allowed authenticated users to execute the execve() plugin in deplo… |
CVE-2024-11401 | | 2024-12-11 | Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks… | |
CVE-2024-10526 | | 2024-11-07 | Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to… | |
CVE-2024-8042 | Low | 2.4 | 2024-09-09 | Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local req… |
CVE-2024-6504 | Medium | 4.3 | 2024-07-18 | Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can… |
CVE-2024-3185 | Medium | 6.8 | 2024-04-23 | A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an atta… |
CVE-2024-0394 | High | 7.8 | 2024-04-03 | Rapid7 Minerva Armor versions below 4.5.5 suffer from a privilege escalation vulnerability whereby an authenticated attacker can elevate privileges and execute… |
CVE-2024-2745 | Low | 3.3 | 2024-04-02 | Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through qu… |
CVE-2023-5950 | High | 8.6 | 2023-11-06 | Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into… |
CVE-2023-2273 | Medium | 5.8 | 2023-04-26 | Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flow… |
CVE-2023-2226 | Low | 3.3 | 2023-04-21 | Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during pars… |
CVE-2023-1699 | Medium | 4.3 | 2023-03-30 | Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability. This vulnerability allows an attacker to manipulate URLs to forcefully… |
CVE-2021-3844 | Medium | 5.7 | 2023-03-24 | Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For examp… |
CVE-2023-1306 | High | 8.8 | 2023-03-21 | An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code exe… |
CVE-2023-1305 | High | 8.1 | 2023-03-21 | An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON… |
CVE-2023-1304 | High | 8.8 | 2023-03-21 | An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expe… |
CVE-2023-0681 | Medium | 4.3 | 2023-03-20 | Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of… |
CVE-2023-0599 | Medium | 6.1 | 2023-02-01 | Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitizatio… |
CVE-2022-3913 | Medium | 5.3 | 2023-02-01 | Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could… |
CVE-2023-0290 | Medium | 4.3 | 2023-01-18 | Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task… |
CVE-2023-0242 | High | 8.8 | 2023-01-18 | Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server i… |
CVE-2017-5242 | High | 7.7 | 2023-01-12 | Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key… |
CVE-2022-4261 | Medium | 4.4 | 2022-12-08 | Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to… |
CVE-2019-5641 | Low | 3.3 | 2022-09-21 | Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Eleme… |
CVE-2022-35632 | Medium | 4.8 | 2022-07-29 | The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not pro… |
CVE-2022-35631 | Medium | 5.5 | 2022-07-29 | On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velocira… |
CVE-2022-35630 | Medium | 6.1 | 2022-07-29 | A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file… |
CVE-2022-35629 | Medium | 5.4 | 2022-07-29 | Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, t… |
CVE-2022-0758 | Low | 3.3 | 2022-03-17 | Rapid7 Nexpose versions 6.6.129 and earlier suffer from a reflected cross site scripting vulnerability, within the shared scan configuration component of the t… |
CVE-2022-0757 | Medium | 5.5 | 2022-03-17 | Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL Injection vulnerability, whereby valid search operators are not defined. This lack of vali… |
CVE-2022-0237 | Medium | 4.0 | 2022-03-17 | Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due t… |
CVE-2021-4016 | Medium | 4.0 | 2022-01-21 | Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An… |
CVE-2021-4007 | High | 7.8 | 2021-12-14 | Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight A… |
CVE-2019-5640 | Low | 3.3 | 2021-11-22 | Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker ca… |
CVE-2021-31868 | Medium | 4.3 | 2021-08-19 | Rapid7 Nexpose version 6.6.95 and earlier allows authenticated users of the Security Console to view and edit any ticket in the legacy ticketing feature, regar… |
CVE-2021-3619 | Low | 3.5 | 2021-07-22 | Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse… |
CVE-2021-3535 | Medium | 4.3 | 2021-06-16 | Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. A specific… |
CVE-2020-7385 | High | 8.1 | 2021-04-23 | By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploi… |
CVE-2020-7384 | High | 7.0 | 2020-10-29 | Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary com… |
CVE-2020-7383 | Medium | 6.5 | 2020-10-14 | A SQL Injection issue in Rapid7 Nexpose version prior to 6.6.49 that may have allowed an authenticated user with a low permission level to access resources & m… |
CVE-2020-7358 | Medium | 5.8 | 2020-09-18 | In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker w… |
CVE-2020-7382 | Medium | 6.8 | 2020-09-03 | Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file… |
CVE-2020-7381 | Medium | 5.8 | 2020-09-03 | In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker… |
CVE-2019-5645 | High | 7.5 | 2020-09-01 | By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When e… |
CVE-2020-7377 | High | 8.1 | 2020-08-24 | The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar meth… |
CVE-2020-7376 | High | 7.1 | 2020-08-24 | The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can… |
CVE-2020-7355 | Medium | 6.1 | 2020-06-25 | Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted n… |
CVE-2020-7354 | Medium | 6.1 | 2020-06-25 | Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted ne… |
CVE-2020-7350 | Medium | 6.1 | 2020-04-22 | Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted use… |
CVE-2012-6494 | Medium | 6.1 | 2020-01-25 | Rapid7 Nexpose before 5.5.4 contains a session hijacking vulnerability which allows remote attackers to capture a user's session and gain unauthorized access. |
CVE-2019-5647 | Medium | 4.4 | 2020-01-22 | The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This b… |
CVE-2019-5642 | Low | 3.3 | 2019-11-06 | Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system duri… |
CVE-2019-5638 | High | 8.7 | 2019-08-21 | Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, lo… |
CVE-2019-5631 | High | 7.8 | 2019-08-19 | The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the sys… |