[ Vendor · 12 CVEs ]
Rapid7
CVEs affecting Rapid7 published in the last 30 days, plus any Rapid7 CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-109682 | 21 Oct 2026 | CVSS 4.7 | Rapid7 Metasploit FrameworkMetasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without… | |
| CVE-2026-109681 | 21 Oct 2026 | CVSS 4.7 | Rapid7 Metasploit FrameworkThe FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any… | |
| CVE-2026-87689 | 13 Oct 2026 | CVSS 9.8 | Rapid7 Metasploit FrameworkThe Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and… | |
| CVE-2026-87690 | 12 Oct 2026 | CVSS 8.8 | Rapid7 Metasploit FrameworkThe Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The… | |
| CVE-2026-78411 | 5 Oct 2026 | CVSS 6.5 | Rapid7 VelociraptorVelociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS… | |
| CVE-2026-78413 | 5 Oct 2026 | CVSS 5.5 | Rapid7 VelociraptorVelociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with… | |
| CVE-2026-78412 | 5 Oct 2026 | CVSS 4.9 | Rapid7 VelociraptorVelociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions… | |
| CVE-2026-97228 | 25 Sep 2026 | CVSS 2.7 | Rapid7 PlatformRapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status`… | |
| CVE-2026-89325 | 24 Sep 2026 | CVSS 7.8 | Rapid7 Insight AgentAn uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute… | |
| CVE-2026-77797 | 24 Sep 2026 | CVSS 3.6 | Rapid7 VelociraptorVelociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files. | |
| CVE-2026-77798 | 24 Sep 2026 | CVSS 6.5 | Rapid7 VelociraptorVelociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user… | |
| CVE-2026-19072 | 24 Sep 2026 | CVSS 9.9 | Rapid7 VelociraptorVelociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although… |