Rapid7 vulnerabilities
135 CVEs and advisories name Rapid7 as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-18635Velociraptor query plugin allows impersonation in other orgs
- CVE-2026-18972Velociraptor authenticated identity-spoofing vulnerability
- CVE-2026-18348Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins
- CVE-2026-14172Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
- CVE-2026-8661Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin
- CVE-2026-8658OS Command Injection in Rapid7 InsightConnect Tcpdump Plugin
- CVE-2026-8662Path Traversal in Rapid7 InsightConnect Compression Plugin
- CVE-2026-8666OS Command Injection in Rapid7 InsightConnect Traceroute Plugin
- CVE-2026-8592OS Command Injection in Rapid7 InsightConnect AWK Plugin
- CVE-2026-8664OS Command Injection in Rapid7 InsightConnect Finger Plugin
- CVE-2026-8665OS Command Injection in Rapid7 InsightConnect Translate Plugin
- CVE-2026-8660OS Command Injection in Rapid7 InsightConnect Ping Plugin
- CVE-2026-9153Arbitrary File Read in Rapid7 InsightConnect Sed Plugin
- CVE-2026-9154Arbitrary File Write in Rapid7 InsightConnect Sed Plugin
- CVE-2026-9155OS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter.
- CVE-2026-8659OS Command Injection in Rapid7 InsightConnect SQLmap Plugin
- CVE-2026-8663OS Command Injection in Rapid7 InsightConnect RPM Plugin
- CVE-2026-8795A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6.
- CVE-2026-7373Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading
- CVE-2026-6863HTTP Filestore Endpoints Misapply Permissions Across Organizations
- CVE-2026-6948Unbounded Memory Allocation in VQLResponse Result-Set Writer
- CVE-2026-6482Local Privilege Escalation via OpenSSL configuration file in Insight Agent
- CVE-2026-6290Velociraptor Query() Plugin Misapplies Permissions To Orgs
- CVE-2026-4482Insight Agent Private Key Information Disclosure via Inherited File Permissions
- CVE-2026-5329Rapid7 Velociraptor Improper Input Validation in Client Message Handler
- CVE-2026-4837Eval Injection in Rapid7 Insight Agent
- CVE-2026-1568Rapid7 InsightVM Signature Validation Vulnerability
- CVE-2026-1814Rapid7 Nexpose Insecure Java Keystore Password Generation
- CVE-2025-14728Rapid7 Velociraptor Directory Traversal Vulnerability
- CVE-2025-11195Rapid7 AppSpider Project Name Validation Bypass