Filtered by vendor Rapid7
Subscribe
Total
91 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-4837 | 1 Rapid7 | 1 Insight Agent | 2026-07-24 | N/A | 6.6 MEDIUM |
| An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform. | |||||
| CVE-2026-7573 | 2 Linux, Rapid7 | 2 Linux Kernel, Velociraptor | 2026-07-24 | N/A | 5.0 MEDIUM |
| An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege user to retrieve the complete ACL policy (roles and permissions) for any user across all organizations by supplying targeted Name and Org parameters via a network request. | |||||
| CVE-2026-7572 | 3 Linux, Microsoft, Rapid7 | 3 Linux Kernel, Windows, Velociraptor | 2026-07-24 | N/A | 4.4 MEDIUM |
| An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service (DoS) via a process crash by providing a specially crafted .evtx file to the parse_evtx VQL plugin. | |||||
| CVE-2026-8659 | 2 Linux, Rapid7 | 2 Linux Kernel, Insightconnect Sqlmap | 2026-06-29 | N/A | 6.0 MEDIUM |
| OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the api_host or api_port parameters during connection configuration due to insufficient input validation. | |||||
| CVE-2026-8663 | 2 Linux, Rapid7 | 2 Linux Kernel, Insightconnect Rpm | 2026-06-29 | N/A | 6.0 MEDIUM |
| OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the repo, key, or name parameters due to insufficient input sanitization in shell command construction. | |||||
| CVE-2026-8592 | 2 Linux, Rapid7 | 2 Linux Kernel, Insightconnect Awk | 2026-06-29 | N/A | 7.7 HIGH |
| OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processing pipeline. | |||||
| CVE-2026-8660 | 2 Linux, Rapid7 | 2 Linux Kernel, Insightconnect Ping | 2026-06-29 | N/A | 7.7 HIGH |
| OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host parameter due to insufficient input validation when constructing shell commands. | |||||
| CVE-2026-8664 | 1 Rapid7 | 1 Insightconnect Finger | 2026-06-29 | N/A | 6.0 MEDIUM |
| OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the user or host parameters due to insufficient input validation in shell command construction. | |||||
| CVE-2026-8665 | 2 Linux, Rapid7 | 2 Linux Kernel, Insightconnect Translate | 2026-06-29 | N/A | 7.7 HIGH |
| OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to insufficient input sanitization in shell command construction. | |||||
| CVE-2026-8666 | 2 Linux, Rapid7 | 2 Linux Kernel, Insightconnect Traceroute | 2026-06-29 | N/A | 7.7 HIGH |
| OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands. | |||||
| CVE-2026-8658 | 2 Linux, Rapid7 | 2 Linux Kernel, Insightconnect Tcpdump | 2026-06-29 | N/A | 6.0 MEDIUM |
| OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the options or filter parameters due to insufficient input sanitization in shell command construction. | |||||
| CVE-2026-8662 | 2 Linux, Rapid7 | 2 Linux Kernel, Insightconnect Compression | 2026-06-29 | N/A | 3.3 LOW |
| Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content cannot be controlled by the attacker. | |||||
| CVE-2026-6482 | 1 Rapid7 | 1 Insight Agent | 2026-06-17 | N/A | 7.8 HIGH |
| The Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of a Windows host. Upon startup the agent service attempts to load an OpenSSL configuration file from a non-existent directory that is writable by standard users. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits an unprivileged user to bypass security controls and achieve a full host compromise under the agent’s SYSTEM level access. | |||||
| CVE-2026-6290 | 1 Rapid7 | 1 Velociraptor | 2026-06-17 | N/A | 8.0 HIGH |
| Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are the same as the permissions they have in the org containing the notebook. | |||||
| CVE-2026-5329 | 1 Rapid7 | 1 Velociraptor | 2026-06-17 | N/A | 8.5 HIGH |
| Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux) that allows an authenticated remote attacker to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name. The server handler that receives client monitoring messages does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues. This may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected by this vulnerability. | |||||
| CVE-2026-4482 | 2 Microsoft, Rapid7 | 2 Windows, Insight Agent | 2026-06-17 | N/A | 5.5 MEDIUM |
| The installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read and execute access). For the client.key file in particular, this could potentially lead to exploits, as this exposes agent identity material to any locally authenticated standard user. | |||||
| CVE-2025-6264 | 1 Rapid7 | 1 Velociraptor | 2026-06-17 | N/A | 5.5 MEDIUM |
| Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role). | |||||
| CVE-2025-4951 | 1 Rapid7 | 1 Appspider Pro | 2026-06-17 | N/A | 4.6 MEDIUM |
| Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field. Despite the application preventing the inclusion of special characters within the "ScanName" field, this could be bypassed by modifying the configuration file directly. This is fixed as of version 7.5.018 | |||||
| CVE-2025-36857 | 1 Rapid7 | 1 Appspider Pro | 2026-06-17 | N/A | 3.3 LOW |
| Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom configuration files. These files, which are loaded in alphabetical order, can override or change the settings of the original configuration files, creating a security vulnerability. This issue stems from improper directory access management. This vulnerability was remediated in version 7.5.021 of the product. | |||||
| CVE-2025-14728 | 2 Linux, Rapid7 | 2 Linux Kernel, Velociraptor | 2026-06-17 | N/A | 6.8 MEDIUM |
| Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a ".", only encoding the final "." AS "%2E". Although files can be written to incorrect locations, the containing directory must end with "%2E". This limits the impact of this vulnerability, and prevents it from overwriting critical files. | |||||