Rapid7 Insightvm
10 CVEs affecting Rapid7 Insightvm. Latest disclosed: 2026-07-24. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14172 | High | 7.8 | 2026-07-24 | Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a l… |
CVE-2017-5242 | High | 7.7 | 2023-01-12 | Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key… |
CVE-2019-5615 | Medium | 6.5 | 2019-04-09 | Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwor… |
CVE-2021-3844 | Medium | 5.7 | 2023-03-24 | Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For examp… |
CVE-2022-3913 | Medium | 5.3 | 2023-02-01 | Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could… |
CVE-2022-4261 | Medium | 4.4 | 2022-12-08 | Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to… |
CVE-2024-6504 | Medium | 4.3 | 2024-07-18 | Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can… |
CVE-2023-0681 | Medium | 4.3 | 2023-03-20 | Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of… |
CVE-2024-2745 | Low | 3.3 | 2024-04-02 | Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through qu… |
CVE-2019-5641 | Low | 3.3 | 2022-09-21 | Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Eleme… |