Login Request a demo
RA
Vendor
Rapid7
37 products with CVEs on record
149
CVEs
0
On KEV
7
New 30D
Products
ME
Metasploit-framework
Rapid7
9.8
6 CVEs0 on KEV4 new
VE
Velociraptor
Rapid7
9.9
42 CVEs0 on KEV3 new
NE
Nexpose
Rapid7
9.8
21 CVEs0 on KEV0 new
ME
Metasploit
Rapid7
9.8
17 CVEs0 on KEV0 new
IA
Insight Agent
Rapid7
7.8
10 CVEs0 on KEV0 new
IN
InsightVM
Rapid7
7.8
9 CVEs0 on KEV0 new
AP
Appspider Pro
Rapid7
7.8
6 CVEs0 on KEV0 new
IN
Insightappsec
Rapid7
8.8
4 CVEs0 on KEV0 new
IN
Insightcloudsec
Rapid7
8.8
3 CVEs0 on KEV0 new
IS
InsightConnect Sed Plugin
Rapid7
8.8
3 CVEs0 on KEV0 new
AP
Appspider
Rapid7
7.1
2 CVEs0 on KEV0 new
IC
Insight Collector
Rapid7
7.8
1 CVEs0 on KEV0 new
IP
Insight Platform
Rapid7
3.1
1 CVEs0 on KEV0 new
IA
Insightconnect Awk
Rapid7
9.8
1 CVEs0 on KEV0 new
IA
InsightConnect AWK Plugin
Rapid7
9.8
1 CVEs0 on KEV0 new
IC
Insightconnect Compression
Rapid7
4.3
1 CVEs0 on KEV0 new
IC
InsightConnect Compression Plugin
Rapid7
4.3
1 CVEs0 on KEV0 new
IF
Insightconnect Finger
Rapid7
8.8
1 CVEs0 on KEV0 new
IF
InsightConnect Finger Plugin
Rapid7
8.8
1 CVEs0 on KEV0 new
IM
InsightConnect Markdown Plugin
Rapid7
4.8
1 CVEs0 on KEV0 new
IP
Insightconnect Ping
Rapid7
9.8
1 CVEs0 on KEV0 new
IP
InsightConnect Ping Plugin
Rapid7
9.8
1 CVEs0 on KEV0 new
IR
Insightconnect Rpm
Rapid7
8.8
1 CVEs0 on KEV0 new
IR
InsightConnect RPM Plugin
Rapid7
8.8
1 CVEs0 on KEV0 new
IS
Insightconnect Sqlmap
Rapid7
8.8
1 CVEs0 on KEV0 new
IS
InsightConnect SQLmap Plugin
Rapid7
8.8
1 CVEs0 on KEV0 new
IT
Insightconnect Tcpdump
Rapid7
8.8
1 CVEs0 on KEV0 new
IT
InsightConnect Tcpdump Plugin
Rapid7
8.8
1 CVEs0 on KEV0 new
IT
InsightConnect TR Plugin
Rapid7
9.8
1 CVEs0 on KEV0 new
IT
Insightconnect Traceroute
Rapid7
9.8
1 CVEs0 on KEV0 new
IT
InsightConnect Traceroute Plugin
Rapid7
9.8
1 CVEs0 on KEV0 new
IT
Insightconnect Translate
Rapid7
9.8
1 CVEs0 on KEV0 new
IN
InsightVM/Nexpose
Rapid7
6.8
1 CVEs0 on KEV0 new
KO
Komand
Rapid7
4.9
1 CVEs0 on KEV0 new
MP
Metasploit Pro
Rapid7
8.5
1 CVEs0 on KEV0 new
PL
Platform
Rapid7
2.7
1 CVEs0 on KEV0 new
VM
Vulnerability Management
Rapid7
9.6
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-109682
MF
Metasploit Framework
Rapid7
4.7
0%
Oct 20Metasploit Framework HTTP Redirect Server-Side Request Forgery
CVE-2026-109681
MF
Metasploit Framework
Rapid7
4.7
0%
Oct 20Metasploit Framework FTP PASV Response SSRF
CVE-2026-87689
MF
Metasploit Framework
Rapid7
9.8
0%
Oct 13Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints
CVE-2026-87690
MF
Metasploit Framework
Rapid7
8.8
0%
Oct 12Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution
CVE-2026-78413
VE
Velociraptor
Rapid7
5.5
0%
Oct 5Velociraptor privilege escalation via SysmonLogForward client monitoring artifact
CVE-2026-78411
VE
Velociraptor
Rapid7
6.5
0%
Oct 5Velociraptor Server Metadata update with Insufficient Permission Check
CVE-2026-78412
VE
Velociraptor
Rapid7
4.9
0%
Oct 5WatchEvent API streams another organization's live events
CVE-2026-97228
PL
Platform
Rapid7
2.7
0%
Sep 25Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup
CVE-2026-89325
IA
Insight Agent
Rapid7
7.8
0%
Sep 24Rapid7 Insight Agent: Uncontrolled search path element in InsightVM assessment content leads to local privilege escalation
CVE-2026-77798
VE
Velociraptor
Rapid7
6.5
0%
Sep 24Velociraptor Authenticated Denial of Service
CVE-2026-77797
VE
Velociraptor
Rapid7
3.6
0%
Sep 24Velociraptor Prefetch parser out of bounds
CVE-2026-19072
VE
Velociraptor
Rapid7
9.9
0%
Sep 24Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal
CVE-2026-19584
VE
Velociraptor
Rapid7
7.7
0%
Sep 10Velociraptor VQL injection during notebook restore from backup
CVE-2026-19583
VE
Velociraptor
Rapid7
9.9
1%
Sep 10Velociraptor Required Permissions bypass by using client monitoring queries
CVE-2026-16895
ME
Metasploit-framework
Rapid7
5.1
0%
Aug 27Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails
CVE-2026-19200
VE
Velociraptor
Rapid7
8.9
0%
Aug 24Velociraptor Analyst overwrites live built-in artifacts through verify()
CVE-2026-15371
VE
Velociraptor
Rapid7
8.1
0%
Aug 18Velociraptor Stored XSS in URL column types
CVE-2026-18652
VE
Velociraptor
Rapid7
6.5
0%
Aug 12Velociraptor STACK Type Download Path Bypasses Denied Prefix Check
CVE-2026-64951
VE
Velociraptor
Rapid7
3.5
0%
Aug 12Velociraptor DoS triggered by Divide by Zero panic
CVE-2026-64952
VE
Velociraptor
Rapid7
6.5
0%
Aug 12Velociraptor Hunt Deletion With Insufficient Permission Check
CVE-2026-64955
VE
Velociraptor
Rapid7
6.1
0%
Aug 12Velociraptor CSV Formula Injection in Export Pipeline
CVE-2026-64954
VE
Velociraptor
Rapid7
8.2
0%
Aug 12Velociraptor collect_client() Permissions Bypass
CVE-2026-18639
VE
Velociraptor
Rapid7
7.3
0%
Aug 11Velociraptor OIDC Authenticator susceptible to email spoofing
CVE-2026-18638
VE
Velociraptor
Rapid7
6.5
0%
Aug 11Velociraptor server crash via the SetPassword API
CVE-2026-18640
VE
Velociraptor
Rapid7
7.1
0%
Aug 11Velociraptor directory traversal via the NewNotebook API
CVE-2026-18860
VE
Velociraptor
Rapid7
8.7
0%
Aug 11Velociraptor incorrect Org deletion permissions check
CVE-2026-17535
VE
Velociraptor
Rapid7
6.2
0%
Aug 11Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes
CVE-2026-18636
VE
Velociraptor
Rapid7
6.8
0%
Aug 11Velociraptor VFSGetBuffer API path deny list bypass
CVE-2026-18635
VE
Velociraptor
Rapid7
7.2
0%
Aug 11Velociraptor query plugin allows impersonation in other orgs
CVE-2026-18972
VE
Velociraptor
Rapid7
9.6
0%
Aug 11Velociraptor authenticated identity-spoofing vulnerability
CVE-2026-18348
VE
Velociraptor
Rapid7
4.1
0%
Aug 11Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins
CVE-2026-14172
NE
Nexpose
Rapid7
7.8
0%
Jul 24Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
CVE-2026-8661
IM
InsightConnect Markdown Plugin
Rapid7
4.8
0%
Jun 26Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin
CVE-2026-8658
IT
InsightConnect Tcpdump Plugin
Rapid7
8.8
1%
Jun 25OS Command Injection in Rapid7 InsightConnect Tcpdump Plugin
CVE-2026-8662
IC
InsightConnect Compression Plugin
Rapid7
4.3
0%
Jun 25Path Traversal in Rapid7 InsightConnect Compression Plugin
CVE-2026-8666
IT
InsightConnect Traceroute Plugin
Rapid7
9.8
1%
Jun 25OS Command Injection in Rapid7 InsightConnect Traceroute Plugin
CVE-2026-8592
IA
InsightConnect AWK Plugin
Rapid7
9.8
1%
Jun 25OS Command Injection in Rapid7 InsightConnect AWK Plugin
CVE-2026-8664
IF
InsightConnect Finger Plugin
Rapid7
8.8
1%
Jun 25OS Command Injection in Rapid7 InsightConnect Finger Plugin
CVE-2026-8665
IT
InsightConnect TR Plugin
Rapid7
9.8
1%
Jun 25OS Command Injection in Rapid7 InsightConnect Translate Plugin
CVE-2026-8660
IP
InsightConnect Ping Plugin
Rapid7
9.8
1%
Jun 25OS Command Injection in Rapid7 InsightConnect Ping Plugin
CVE-2026-9153
IS
InsightConnect Sed Plugin
Rapid7
6.5
0%
Jun 25Arbitrary File Read in Rapid7 InsightConnect Sed Plugin
CVE-2026-9154
IS
InsightConnect Sed Plugin
Rapid7
6.5
0%
Jun 25Arbitrary File Write in Rapid7 InsightConnect Sed Plugin
CVE-2026-9155
IS
InsightConnect Sed Plugin
Rapid7
8.8
2%
Jun 25OS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter.
CVE-2026-8659
IS
InsightConnect SQLmap Plugin
Rapid7
8.8
1%
Jun 25OS Command Injection in Rapid7 InsightConnect SQLmap Plugin
CVE-2026-8663
IR
InsightConnect RPM Plugin
Rapid7
8.8
1%
Jun 24OS Command Injection in Rapid7 InsightConnect RPM Plugin
CVE-2026-8795
VE
Velociraptor
Rapid7
7.8
0%
Jun 9A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6
CVE-2026-7373
MP
Metasploit Pro
Rapid7
8.5
0%
May 15Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading
CVE-2026-6863
VE
Velociraptor
Rapid7
6.8
0%
May 6HTTP Filestore Endpoints Misapply Permissions Across Organizations
CVE-2026-7572
VE
Velociraptor
Rapid7
5.5
0%
May 6Velociraptor EVTX Parser — Process Crash via Crafted .evtx File
CVE-2026-7573
VE
Velociraptor
Rapid7
7.7
0%
May 6GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations
CVE-2026-6948
VE
Velociraptor
Rapid7
4.9
0%
May 3Unbounded Memory Allocation in VQLResponse Result-Set Writer
CVE-2026-6482
IA
Insight Agent
Rapid7
7.8
0%
Apr 17Local Privilege Escalation via OpenSSL configuration file in Insight Agent
CVE-2026-6290
VE
Velociraptor
Rapid7
9.1
0%
Apr 15Velociraptor Query() Plugin Misapplies Permissions To Orgs
CVE-2026-4482
IA
Insight Agent
Rapid7
5.5
0%
Apr 10Insight Agent Private Key Information Disclosure via Inherited File Permissions
CVE-2026-5329
VE
Velociraptor
Rapid7
6.5
0%
Apr 9Rapid7 Velociraptor Improper Input Validation in Client Message Handler
CVE-2026-4837
IA
Insight Agent
Rapid7
7.2
0%
Apr 8Eval Injection in Rapid7 Insight Agent
CVE-2026-1568
VM
Vulnerability Management
Rapid7
9.6
0%
Feb 3Rapid7 InsightVM Signature Validation Vulnerability
CVE-2026-1814
IN
InsightVM/Nexpose
Rapid7
6.8
0%
Feb 3Rapid7 Nexpose Insecure Java Keystore Password Generation
CVE-2025-14728
VE
Velociraptor
Rapid7
6.8
1%
Dec 29Rapid7 Velociraptor Directory Traversal Vulnerability
CVE-2025-11195
AP
Appspider Pro
Rapid7
3.3
0%
Sep 30Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file…