Rapid7 vulnerabilities
135 CVEs and advisories name Rapid7 as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-36857Rapid7 Appspider Broken Access Control Vulnerability
- CVE-2025-6264Velociraptor priviledge escalation via UpdateConfig artifact
- CVE-2025-4951Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field
- CVE-2025-0914Velociraptor Shell Plugin Prevent_execve Bypass
- CVE-2024-11401Rapid7 Insight Platform Privilege Escalation Vulnerability
- CVE-2024-10526Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service
- CVE-2024-8042Rapid7 Insight Platform Unauthorized Empty Group Creation
- CVE-2024-6504Rapid7 InsightVM Protection Mechanism Failure
- CVE-2024-3185Rapid7 Insight Agent Sensitive Key Exposed To Local Users
- CVE-2024-0394Rapid7 Minerva Armor Privilege Escalation
- CVE-2024-2745Rapid7 InsightVM Sensitive Information Exposure via URL
- CVE-2023-5950Rapid7 Velociraptor Reflected XSS
- CVE-2023-2273Rapid7 Insight Agent Directory Traversal
- CVE-2023-2226Velociraptor crashes while parsing some malformed PE or OLE files.
- CVE-2023-1699Rapid7 Nexpose Forced Browsing
- CVE-2021-3844Rapid7 InsightVM Insufficient Session Expiration
- CVE-2023-1306Rapid7 InsightCloudSec resource.db() method access
- CVE-2023-1305Rapid7 InsightCloudSec box object access
- CVE-2023-1304Rapid7 InsightCloudSec getattr() method access
- CVE-2023-0681Rapid7 Nexpose Uncontrolled URL Redirect
- CVE-2023-0599Rapid7 Metasploit Pro Stored XSS
- CVE-2022-3913Rapid7 Nexpose Certificate Validation Issue
- CVE-2023-0290Rapid7 Velociraptor directory traversal in client ID parameter
- CVE-2023-0242Insufficient permission check in the VQL copy() function
- CVE-2017-5242Rapid7 Nexpose Virtual Appliance Duplicate SSH Host Key
- CVE-2022-4261Rapid7 Nexpose Update Validation Issue
- CVE-2019-5641Rapid7 InsightVM Information Disclosure after Logout
- CVE-2022-35632XSS in User Interface
- CVE-2022-35631Filesystem race on temporary files
- CVE-2022-35630Unsafe HTML Injection in Artifact Collection Report