# cve.now: Rapid7

The newest entries naming Rapid7 as an affected vendor (up to 200), of 135 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121139](https://cve.now/CVE-2026-121139.md): Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authentication (CVSS 7.3)
- [CVE-2026-115805](https://cve.now/CVE-2026-115805.md): Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path (CVSS 7.8)
- [CVE-2026-109682](https://cve.now/CVE-2026-109682.md): Metasploit Framework HTTP Redirect Server-Side Request Forgery (CVSS 4.7)
- [CVE-2026-109681](https://cve.now/CVE-2026-109681.md): Metasploit Framework FTP PASV Response SSRF (CVSS 4.7)
- [CVE-2026-87689](https://cve.now/CVE-2026-87689.md): Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints (CVSS 9.8)
- [CVE-2026-87690](https://cve.now/CVE-2026-87690.md): Metasploit Framework ios\_image\_gather Path Traversal Leading to Arbitrary File Write and Code Execution (CVSS 8.8)
- [CVE-2026-78413](https://cve.now/CVE-2026-78413.md): Velociraptor privilege escalation via SysmonLogForward client monitoring artifact (CVSS 5.5)
- [CVE-2026-78411](https://cve.now/CVE-2026-78411.md): Velociraptor Server Metadata update with Insufficient Permission Check (CVSS 6.5)
- [CVE-2026-78412](https://cve.now/CVE-2026-78412.md): WatchEvent API streams another organization's live events (CVSS 4.9)
- [CVE-2026-97228](https://cve.now/CVE-2026-97228.md): Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup (CVSS 2.7)
- [CVE-2026-89325](https://cve.now/CVE-2026-89325.md): Rapid7 Insight Agent: Uncontrolled search path element in InsightVM assessment content leads to local privilege escalation (CVSS 7.8)
- [CVE-2026-77798](https://cve.now/CVE-2026-77798.md): Velociraptor Authenticated Denial of Service (CVSS 6.5)
- [CVE-2026-77797](https://cve.now/CVE-2026-77797.md): Velociraptor Prefetch parser out of bounds (CVSS 3.6)
- [CVE-2026-19072](https://cve.now/CVE-2026-19072.md): Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal (CVSS 9.9)
- [CVE-2026-19584](https://cve.now/CVE-2026-19584.md): Velociraptor VQL injection during notebook restore from backup (CVSS 7.7)
- [CVE-2026-19583](https://cve.now/CVE-2026-19583.md): Velociraptor Required Permissions bypass by using client monitoring queries (CVSS 9.9)
- [CVE-2026-16895](https://cve.now/CVE-2026-16895.md): Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails (CVSS 5.1)
- [CVE-2026-19200](https://cve.now/CVE-2026-19200.md): Velociraptor Analyst overwrites live built-in artifacts through verify() (CVSS 8.9)
- [CVE-2026-15371](https://cve.now/CVE-2026-15371.md): Velociraptor Stored XSS in URL column types (CVSS 8.1)
- [CVE-2026-18652](https://cve.now/CVE-2026-18652.md): Velociraptor STACK Type Download Path Bypasses Denied Prefix Check (CVSS 6.5)
- [CVE-2026-64951](https://cve.now/CVE-2026-64951.md): Velociraptor DoS triggered by Divide by Zero panic (CVSS 3.5)
- [CVE-2026-64952](https://cve.now/CVE-2026-64952.md): Velociraptor Hunt Deletion With Insufficient Permission Check (CVSS 6.5)
- [CVE-2026-64955](https://cve.now/CVE-2026-64955.md): Velociraptor CSV Formula Injection in Export Pipeline (CVSS 6.1)
- [CVE-2026-64954](https://cve.now/CVE-2026-64954.md): Velociraptor collect\_client() Permissions Bypass (CVSS 8.2)
- [CVE-2026-18639](https://cve.now/CVE-2026-18639.md): Velociraptor OIDC Authenticator susceptible to email spoofing (CVSS 7.3)
- [CVE-2026-18638](https://cve.now/CVE-2026-18638.md): Velociraptor server crash via the SetPassword API (CVSS 6.5)
- [CVE-2026-18640](https://cve.now/CVE-2026-18640.md): Velociraptor directory traversal via the NewNotebook API (CVSS 7.1)
- [CVE-2026-18860](https://cve.now/CVE-2026-18860.md): Velociraptor incorrect Org deletion permissions check (CVSS 8.7)
- [CVE-2026-17535](https://cve.now/CVE-2026-17535.md): Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes (CVSS 6.2)
- [CVE-2026-18636](https://cve.now/CVE-2026-18636.md): Velociraptor VFSGetBuffer API path deny list bypass (CVSS 6.8)
- [CVE-2026-18635](https://cve.now/CVE-2026-18635.md): Velociraptor query plugin allows impersonation in other orgs (CVSS 7.2)
- [CVE-2026-18972](https://cve.now/CVE-2026-18972.md): Velociraptor authenticated identity-spoofing vulnerability (CVSS 9.6)
- [CVE-2026-18348](https://cve.now/CVE-2026-18348.md): Velociraptor NETWORK ACL bypass via upload\_azure / upload\_sftp / upload\_smb VQL plugins (CVSS 4.1)
- [CVE-2026-14172](https://cve.now/CVE-2026-14172.md): Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation (CVSS 7.8)
- [CVE-2026-8661](https://cve.now/CVE-2026-8661.md): Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin (CVSS 4.8)
- [CVE-2026-8658](https://cve.now/CVE-2026-8658.md): OS Command Injection in Rapid7 InsightConnect Tcpdump Plugin (CVSS 6.0)
- [CVE-2026-8662](https://cve.now/CVE-2026-8662.md): Path Traversal in Rapid7 InsightConnect Compression Plugin (CVSS 3.3)
- [CVE-2026-8666](https://cve.now/CVE-2026-8666.md): OS Command Injection in Rapid7 InsightConnect Traceroute Plugin (CVSS 7.7)
- [CVE-2026-8592](https://cve.now/CVE-2026-8592.md): OS Command Injection in Rapid7 InsightConnect AWK Plugin (CVSS 7.7)
- [CVE-2026-8664](https://cve.now/CVE-2026-8664.md): OS Command Injection in Rapid7 InsightConnect Finger Plugin (CVSS 6.0)
- [CVE-2026-8665](https://cve.now/CVE-2026-8665.md): OS Command Injection in Rapid7 InsightConnect Translate Plugin (CVSS 7.7)
- [CVE-2026-8660](https://cve.now/CVE-2026-8660.md): OS Command Injection in Rapid7 InsightConnect Ping Plugin (CVSS 7.7)
- [CVE-2026-9153](https://cve.now/CVE-2026-9153.md): Arbitrary File Read in Rapid7 InsightConnect Sed Plugin (CVSS 6.5)
- [CVE-2026-9154](https://cve.now/CVE-2026-9154.md): Arbitrary File Write in Rapid7 InsightConnect Sed Plugin (CVSS 7.1)
- [CVE-2026-9155](https://cve.now/CVE-2026-9155.md): OS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter. (CVSS 8.8)
- [CVE-2026-8659](https://cve.now/CVE-2026-8659.md): OS Command Injection in Rapid7 InsightConnect SQLmap Plugin (CVSS 6.0)
- [CVE-2026-8663](https://cve.now/CVE-2026-8663.md): OS Command Injection in Rapid7 InsightConnect RPM Plugin (CVSS 6.0)
- [CVE-2026-8795](https://cve.now/CVE-2026-8795.md): A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. (CVSS 7.8)
- [CVE-2026-7373](https://cve.now/CVE-2026-7373.md): Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading (CVSS 8.5)
- [CVE-2026-6863](https://cve.now/CVE-2026-6863.md): HTTP Filestore Endpoints Misapply Permissions Across Organizations (CVSS 6.8)
- [CVE-2026-6948](https://cve.now/CVE-2026-6948.md): Unbounded Memory Allocation in VQLResponse Result-Set Writer (CVSS 4.9)
- [CVE-2026-6482](https://cve.now/CVE-2026-6482.md): Local Privilege Escalation via OpenSSL configuration file in Insight Agent (CVSS 8.5)
- [CVE-2026-6290](https://cve.now/CVE-2026-6290.md): Velociraptor Query() Plugin Misapplies Permissions To Orgs (CVSS 8.0)
- [CVE-2026-4482](https://cve.now/CVE-2026-4482.md): Insight Agent Private Key Information Disclosure via Inherited File Permissions (CVSS 6.8)
- [CVE-2026-5329](https://cve.now/CVE-2026-5329.md): Rapid7 Velociraptor Improper Input Validation in Client Message Handler (CVSS 8.5)
- [CVE-2026-4837](https://cve.now/CVE-2026-4837.md): Eval Injection in Rapid7 Insight Agent (CVSS 6.6)
- [CVE-2026-1568](https://cve.now/CVE-2026-1568.md): Rapid7 InsightVM Signature Validation Vulnerability (CVSS 9.6)
- [CVE-2026-1814](https://cve.now/CVE-2026-1814.md): Rapid7 Nexpose Insecure Java Keystore Password Generation (CVSS 6.8)
- [CVE-2025-14728](https://cve.now/CVE-2025-14728.md): Rapid7 Velociraptor Directory Traversal Vulnerability (CVSS 6.8)
- [CVE-2025-11195](https://cve.now/CVE-2025-11195.md): Rapid7 AppSpider Project Name Validation Bypass (CVSS 3.3)
- [CVE-2025-36857](https://cve.now/CVE-2025-36857.md): Rapid7 Appspider Broken Access Control Vulnerability (CVSS 3.3)
- [CVE-2025-6264](https://cve.now/CVE-2025-6264.md): Velociraptor priviledge escalation via UpdateConfig artifact (CVSS 5.5)
- [CVE-2025-4951](https://cve.now/CVE-2025-4951.md): Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field (CVSS 4.6)
- [CVE-2025-0914](https://cve.now/CVE-2025-0914.md): Velociraptor Shell Plugin Prevent\_execve Bypass (CVSS 3.8)
- [CVE-2024-11401](https://cve.now/CVE-2024-11401.md): Rapid7 Insight Platform Privilege Escalation Vulnerability (CVSS 5.3)
- [CVE-2024-10526](https://cve.now/CVE-2024-10526.md): Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service (CVSS 8.6)
- [CVE-2024-8042](https://cve.now/CVE-2024-8042.md): Rapid7 Insight Platform Unauthorized Empty Group Creation (CVSS 2.4)
- [CVE-2024-6504](https://cve.now/CVE-2024-6504.md): Rapid7 InsightVM Protection Mechanism Failure (CVSS 4.3)
- [CVE-2024-3185](https://cve.now/CVE-2024-3185.md): Rapid7 Insight Agent Sensitive Key Exposed To Local Users (CVSS 6.8)
- [CVE-2024-0394](https://cve.now/CVE-2024-0394.md): Rapid7 Minerva Armor Privilege Escalation (CVSS 7.8)
- [CVE-2024-2745](https://cve.now/CVE-2024-2745.md): Rapid7 InsightVM Sensitive Information Exposure via URL (CVSS 3.3)
- [CVE-2023-5950](https://cve.now/CVE-2023-5950.md): Rapid7 Velociraptor Reflected XSS (CVSS 8.6)
- [CVE-2023-2273](https://cve.now/CVE-2023-2273.md): Rapid7 Insight Agent Directory Traversal (CVSS 5.8)
- [CVE-2023-2226](https://cve.now/CVE-2023-2226.md): Velociraptor crashes while parsing some malformed PE or OLE files. (CVSS 3.3)
- [CVE-2023-1699](https://cve.now/CVE-2023-1699.md): Rapid7 Nexpose Forced Browsing (CVSS 4.3)
- [CVE-2021-3844](https://cve.now/CVE-2021-3844.md): Rapid7 InsightVM Insufficient Session Expiration (CVSS 5.7)
- [CVE-2023-1306](https://cve.now/CVE-2023-1306.md): Rapid7 InsightCloudSec resource.db() method access (CVSS 8.8)
- [CVE-2023-1305](https://cve.now/CVE-2023-1305.md): Rapid7 InsightCloudSec box object access (CVSS 8.1)
- [CVE-2023-1304](https://cve.now/CVE-2023-1304.md): Rapid7 InsightCloudSec getattr() method access (CVSS 8.8)
- [CVE-2023-0681](https://cve.now/CVE-2023-0681.md): Rapid7 Nexpose Uncontrolled URL Redirect (CVSS 4.3)
- [CVE-2023-0599](https://cve.now/CVE-2023-0599.md): Rapid7 Metasploit Pro Stored XSS (CVSS 6.1)
- [CVE-2022-3913](https://cve.now/CVE-2022-3913.md): Rapid7 Nexpose Certificate Validation Issue (CVSS 5.3)
- [CVE-2023-0290](https://cve.now/CVE-2023-0290.md): Rapid7 Velociraptor directory traversal in client ID parameter (CVSS 4.3)
- [CVE-2023-0242](https://cve.now/CVE-2023-0242.md): Insufficient permission check in the VQL copy() function (CVSS 8.8)
- [CVE-2017-5242](https://cve.now/CVE-2017-5242.md): Rapid7 Nexpose Virtual Appliance Duplicate SSH Host Key (CVSS 7.7)
- [CVE-2022-4261](https://cve.now/CVE-2022-4261.md): Rapid7 Nexpose Update Validation Issue (CVSS 4.4)
- [CVE-2019-5641](https://cve.now/CVE-2019-5641.md): Rapid7 InsightVM Information Disclosure after Logout (CVSS 3.3)
- [CVE-2022-35632](https://cve.now/CVE-2022-35632.md): XSS in User Interface (no CVSS)
- [CVE-2022-35631](https://cve.now/CVE-2022-35631.md): Filesystem race on temporary files (no CVSS)
- [CVE-2022-35630](https://cve.now/CVE-2022-35630.md): Unsafe HTML Injection in Artifact Collection Report (no CVSS)
- [CVE-2022-35629](https://cve.now/CVE-2022-35629.md): Velociraptor Client ID Spoofing (no CVSS)
- [CVE-2022-0758](https://cve.now/CVE-2022-0758.md): Rapid7 Nexpose Reflected XSS (CVSS 3.3)
- [CVE-2022-0757](https://cve.now/CVE-2022-0757.md): Rapid7 Nexpose SQL Injection (CVSS 5.5)
- [CVE-2022-0237](https://cve.now/CVE-2022-0237.md): Rapid7 Insight Agent Privilege Escalation (CVSS 4.0)
- [CVE-2021-4016](https://cve.now/CVE-2021-4016.md): Rapid7 Insight Agent Improper Access Control (CVSS 4.0)
- [CVE-2021-4007](https://cve.now/CVE-2021-4007.md): Rapid7 Insight Agent Privilege Escalation (CVSS 7.8)
- [CVE-2019-5640](https://cve.now/CVE-2019-5640.md): Rapid7 Nexpose Information Disclosure after logout (CVSS 3.3)
- [CVE-2021-31868](https://cve.now/CVE-2021-31868.md): Rapid7 Nexpose Security Console Ticket Access Authentication Vulnerability (CVSS 4.3)
- [CVE-2021-3619](https://cve.now/CVE-2021-3619.md): Rapid7 Velociraptor Notebooks Authenticated Persistent XSS (CVSS 3.5)
- [CVE-2021-3535](https://cve.now/CVE-2021-3535.md): Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search f (CVSS 4.3)
- [CVE-2020-7385](https://cve.now/CVE-2020-7385.md): Metasploit Framework 'drb\_remote\_codeexec' code execution (CVSS 8.1)
- [CVE-2020-7384](https://cve.now/CVE-2020-7384.md): Client-Side Command Injection in Rapid7 Metasploit (CVSS 7.0)
- [CVE-2020-7383](https://cve.now/CVE-2020-7383.md): SQL Injection in Rapid7 Nexpose (CVSS 6.5)
- [CVE-2020-7358](https://cve.now/CVE-2020-7358.md): Code Injection in Rapid7 AppSpider Pro Installer (CVSS 5.8)
- [CVE-2020-7382](https://cve.now/CVE-2020-7382.md): Unquoted Path in Rapid7 Nexpose Installer (CVSS 6.8)
- [CVE-2020-7381](https://cve.now/CVE-2020-7381.md): Code Injection in Rapid7 Nexpose Installer (CVSS 5.8)
- [CVE-2019-5645](https://cve.now/CVE-2019-5645.md): Rapid7 Metasploit HTTP Handler Denial of Service (CVSS 7.5)
- [CVE-2020-7377](https://cve.now/CVE-2020-7377.md): Rapid7 Metasploit Framework Relative Path Traversal in telpho10\_credential\_dump module (CVSS 8.1)
- [CVE-2020-7376](https://cve.now/CVE-2020-7376.md): Rapid7 Metasploit Framework Relative Path Traversal in enum\_osx module (CVSS 7.1)
- [CVE-2020-7355](https://cve.now/CVE-2020-7355.md): Rapid7 Metasploit Pro Stored XSS in 'notes' field (CVSS 6.1)
- [CVE-2020-7354](https://cve.now/CVE-2020-7354.md): Rapid7 Metasploit Pro Stored XSS in 'host' field (CVSS 6.1)
- [CVE-2020-7350](https://cve.now/CVE-2020-7350.md): Metasploit Framework Plugin Libnotify Command Injection (CVSS 6.1)
- [CVE-2019-5647](https://cve.now/CVE-2019-5647.md): Rapid7 AppSpider Chrome Plugin Insufficient Session Expiration (CVSS 4.4)
- [CVE-2019-5642](https://cve.now/CVE-2019-5642.md): MAGICK (CVSS 3.3)
- [CVE-2019-5638](https://cve.now/CVE-2019-5638.md): Rapid7 Nexpose Insufficient Session Management (CVSS 8.7)
- [CVE-2019-5631](https://cve.now/CVE-2019-5631.md): Rapid7 InsightAppSec Local Privilege Escalation (CVSS 7.8)
- [CVE-2019-5629](https://cve.now/CVE-2019-5629.md): Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. (CVSS 7.8)
- [CVE-2019-5630](https://cve.now/CVE-2019-5630.md): Rapid7 Nexpose/InsightVM Security Console CSRF (CVSS 5.9)
- [CVE-2019-5624](https://cve.now/CVE-2019-5624.md): Rapid7 Metasploit Framework Zip Import Directory Traversal (CVSS 7.4)
- [CVE-2019-5615](https://cve.now/CVE-2019-5615.md): Rapid7 InsightVM Stored Credential Exposure (CVSS 3.1)
- [CVE-2018-5559](https://cve.now/CVE-2018-5559.md): In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return (CVSS 3.4)
- [CVE-2017-5264](https://cve.now/CVE-2017-5264.md): Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrativ (no CVSS)
- [CVE-2017-5244](https://cve.now/CVE-2017-5244.md): Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. (no CVSS)
- [CVE-2017-5243](https://cve.now/CVE-2017-5243.md): The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exc (no CVSS)
- [CVE-2017-5240](https://cve.now/CVE-2017-5240.md): Editions of Rapid7 AppSpider Pro prior to version 6.14.060 contain a heap-based buffer overflow in the FLAnalyzer.exe component. (no CVSS)
- [CVE-2017-5236](https://cve.now/CVE-2017-5236.md): Editions of Rapid7 AppSpider Pro installers prior to version 6.14.060 contain a DLL preloading vulnerability, wherein it is possible for the (no CVSS)
- [CVE-2017-5235](https://cve.now/CVE-2017-5235.md): Rapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the i (no CVSS)
- [CVE-2017-5234](https://cve.now/CVE-2017-5234.md): Rapid7 Insight Collector installers prior to version 1.0.16 contain a DLL preloading vulnerability, wherein it is possible for the installer (no CVSS)
- [CVE-2017-5233](https://cve.now/CVE-2017-5233.md): Rapid7 AppSpider Pro installers prior to version 6.14.053 contain a DLL preloading vulnerability, wherein it is possible for the installer t (no CVSS)
- [CVE-2017-5232](https://cve.now/CVE-2017-5232.md): All editions of Rapid7 Nexpose installers prior to version 6.4.24 contain a DLL preloading vulnerability, wherein it is possible for the ins (no CVSS)
- [CVE-2017-5231](https://cve.now/CVE-2017-5231.md): All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi C (no CVSS)
- [CVE-2017-5230](https://cve.now/CVE-2017-5230.md): The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' whi (no CVSS)
- [CVE-2017-5229](https://cve.now/CVE-2017-5229.md): All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi C (no CVSS)
- [CVE-2017-5228](https://cve.now/CVE-2017-5228.md): All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi D (no CVSS)
- [CVE-2016-9757](https://cve.now/CVE-2016-9757.md): In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags ca (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/rapid7
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.