Skip to content
OpenAdvisories

Vendor

Rapid7

135 known vulnerabilities.

Products

Velociraptor 42 Nexpose 17 Insight Agent 12 Metasploit Framework 12 InsightVM 8 Appspider Pro 6 Metasploit Pro 6 Metasploit 4 InsightCloudSec 3 InsightConnect Sed Plugin 3 AppSpider 2 Insight Platform 2 Rapid7 Nexpose 1 Platform 1 InsightAppSec 1 InsightConnect Ping Plugin 1 Vulnerability Management 1 InsightConnect Finger Plugin 1 InsightConnect Markdown Plugin 1 InsightConnect Traceroute Plugin 1 Minerva 1 InsightConnect AWK Plugin 1 Insight Collector 1 Nexpose hardware appliance 1 Nexpose/InsightVM Security Console 1 Nexpose Virtual Appliance 1 InsightVM Virtual Appliance 1 Metasploit (Pro, Express, and Community editions) 1 InsightConnect SQLmap Plugin 1 Komand 1 InsightConnect RPM Plugin 1 InsightConnect Compression Plugin 1 InsightConnect Tcpdump Plugin 1 InsightConnect TR Plugin 1 InsightVM/Nexpose 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-1814 Public exploit

    Rapid7 Nexpose Insecure Java Keystore Password Generation

    Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient le…

    Rapid7 InsightVM/Nexpose
  • Medium 5.5
    CVE-2025-6264 Public exploit

    Velociraptor priviledge escalation via UpdateConfig artifact

    Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.  To limit access to some dangerous artifact, Velociraptor allows for those to require h…

    Rapid7 Velociraptor www.velocidex.com/golang/velociraptor Go
  • Medium 6.1
    CVE-2020-7350 Public exploit

    Metasploit Framework Plugin Libnotify Command Injection

    Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially…

    Rapid7 Metasploit Framework
  • Medium 5.9
    CVE-2019-5630 Public exploit

    Rapid7 Nexpose/InsightVM Security Console CSRF

    A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-f…

    Rapid7 Nexpose/InsightVM Security Console