Vulnerabilities in Rapid7
135 resultsCVE-2020-7358MEDIUMCode Injection in Rapid7 AppSpider Pro InstallerEPSS 0.3%CVE-2026-64951LOWVelociraptor DoS triggered by Divide by Zero panicEPSS 0.3%CVE-2026-97228LOWRapid7 Bulk Export MCP — GraphQL Query Injection in Export Status LookupEPSS 0.2%CVE-2026-6863MEDIUMHTTP Filestore Endpoints Misapply Permissions Across OrganizationsEPSS 0.2%CVE-2024-0394HIGHRapid7 Minerva Armor Privilege EscalationEPSS 0.2%CVE-2026-16895MEDIUMAuthentication Bypass in Metasploit JSON-RPC Service When DB Health Check FailsEPSS 0.2%CVE-2025-0914LOWVelociraptor Shell Plugin Prevent_execve BypassEPSS 0.2%CVE-2022-35631—Filesystem race on temporary filesEPSS 0.2%CVE-2026-6290HIGHVelociraptor Query() Plugin Misapplies Permissions To OrgsEPSS 0.2%CVE-2026-78412MEDIUMWatchEvent API streams another organization's live eventsEPSS 0.2%CVE-2021-4016MEDIUMRapid7 Insight Agent Improper Access ControlEPSS 0.2%CVE-2026-109681MEDIUMMetasploit Framework FTP PASV Response SSRFEPSS 0.2%CVE-2026-77798MEDIUMVelociraptor Authenticated Denial of ServiceEPSS 0.2%CVE-2025-4951MEDIUMEditions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" fieldEPSS 0.2%CVE-2026-78411MEDIUMVelociraptor Server Metadata update with Insufficient Permission CheckEPSS 0.2%CVE-2024-8042LOWRapid7 Insight Platform Unauthorized Empty Group CreationEPSS 0.2%CVE-2024-2745LOWRapid7 InsightVM Sensitive Information Exposure via URLEPSS 0.2%CVE-2026-6482HIGHLocal Privilege Escalation via OpenSSL configuration file in Insight AgentEPSS 0.2%CVE-2024-3185MEDIUMRapid7 Insight Agent Sensitive Key Exposed To Local UsersEPSS 0.2%CVE-2024-10526HIGHRapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor ServiceEPSS 0.2%