Rapid7 vulnerabilities

CVEs per yearBy the year they were published

1. 20161
2. 201713
3. 20181
4. 20197
5. 202012
6. 20216
7. 202210
8. 202314
9. 20247
10. 20256
11. 202658

Newest CVEs

• CVE-2026-121139

  Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authentication

  Rapid7 · Metasploit Framework

  High7.3
• CVE-2026-115805

  Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path

  Rapid7 · Insight Agent

  High7.8
• CVE-2026-109682

  Metasploit Framework HTTP Redirect Server-Side Request Forgery

  Rapid7 · Metasploit Framework

  Medium4.7
• CVE-2026-109681

  Metasploit Framework FTP PASV Response SSRF

  Rapid7 · Metasploit Framework

  Medium4.7
• CVE-2026-87689

  Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints

  Rapid7 · Metasploit Framework

  Critical9.8
• CVE-2026-87690

  Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution

  Rapid7 · Metasploit Framework

  High8.8
• CVE-2026-78413

  Velociraptor privilege escalation via SysmonLogForward client monitoring artifact

  Rapid7 · Velociraptor

  Medium5.5
• CVE-2026-78411

  Velociraptor Server Metadata update with Insufficient Permission Check

  Rapid7 · Velociraptor

  Medium6.5
• CVE-2026-78412

  WatchEvent API streams another organization's live events

  Rapid7 · Velociraptor

  Medium4.9
• CVE-2026-97228

  Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

  Rapid7 · Platform

  Low2.7