Rapid7 vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-87689 The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet.Critical 9.8 · Oct 12, 2026
• CVE-2026-87690 The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22).High 8.8 · Oct 12, 2026
• CVE-2026-89325 An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary High 7.8 · Sep 24, 2026
• CVE-2026-19072 Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt.Critical 9.9 · Sep 24, 2026
• CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature.High 7.7 · Sep 9, 2026
• CVE-2026-19583 Velociraptor allows some sensitive artifacts to be gated by additional permissions.Critical 9.9 · Sep 9, 2026
• CVE-2026-19200 The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues.High 8.9 · Aug 24, 2026
• CVE-2026-15371 Velociraptor's web GUI allows specifying a custom type for columns in tables.High 8.1 · Aug 18, 2026
• CVE-2026-64954 Velociraptor allows scheduling new collections via VQL queries in notebooks.High 8.2 · Aug 12, 2026
• CVE-2026-18640 The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outsHigh 7.1 · Aug 11, 2026
• CVE-2026-18639 When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username.High 7.3 · Aug 11, 2026
• CVE-2026-18860 Velociraptor allows multi-tenant deployments named "Orgs".High 8.7 · Aug 11, 2026
• CVE-2026-18635 Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context.High 7.2 · Aug 11, 2026
• CVE-2026-18972 An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\".Critical 9.6 · Aug 11, 2026
• CVE-2026-14172 Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a loHigh 7.8 · Jul 24, 2026
• CVE-2026-8666 OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS High 7.7 · Jun 24, 2026
• CVE-2026-8665 OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands High 7.7 · Jun 24, 2026
• CVE-2026-8660 OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands viaHigh 7.7 · Jun 24, 2026
• CVE-2026-8592 OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS comHigh 7.7 · Jun 24, 2026
• CVE-2026-9155 OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the expressiHigh 8.8 · Jun 24, 2026
• CVE-2026-9154 Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitraryHigh 7.1 · Jun 24, 2026
• CVE-2026-8795 A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6.High 7.8 · Jun 8, 2026
• CVE-2026-7373 Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host.High 8.5 · May 14, 2026
• CVE-2026-6482 The Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of a Windows hHigh 8.5 · Apr 17, 2026
• CVE-2026-6290 Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token.High 8 · Apr 15, 2026