Rapid7 security advisories

25 advisories across Rapid7

Date	Advisory	Severity	Fixed in
Sep 25	Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query... Low2.7Sep 25 CVE-2026-972280.6.2	Low2.7	0.6.2
Sep 24	Rapid7 Insight Agent: code execution High7.8Sep 24 CVE-2026-89325No fix yet	High7.8	No fix yet
Sep 24	Rapid7 Velociraptor: improper input validation Low3.6Sep 24 CVE-2026-777970.77.3	Low3.6	0.77.3
Sep 24	Velociraptor contains a deadlock condition Medium6.5Sep 24 CVE-2026-777980.77.2	Medium6.5	0.77.2
Sep 24	Velociraptor stores the compiled VQL in the hunt object internally to avoid... Critical9.9Sep 24 CVE-2026-190720.77.2	Critical9.9	0.77.2
Sep 10	Rapid7 Velociraptor: code injection High7.7Sep 10 CVE-2026-195840.77.2	High7.7	0.77.2
Sep 10	Rapid7 Velociraptor: insecure permissions Critical9.9Sep 10 CVE-2026-195830.77.2	Critical9.9	0.77.2
Aug 27	A logic vulnerability Medium5.1Aug 27 CVE-2026-168956.5.2	Medium5.1	6.5.2
Aug 24	Rapid7 Velociraptor: code injection High8.9Aug 24 CVE-2026-192000.77.2	High8.9	0.77.2
Aug 18	Rapid7 Velociraptor: cross-site scripting High8.1Aug 18 CVE-2026-153710.77.2	High8.1	0.77.2
Aug 12	A rogue Velociraptor client can upload a malformed sparse file such Low3.5Aug 12 CVE-2026-649510.77.2	Low3.5	0.77.2
Aug 12	Rapid7 Velociraptor: improper authorization Medium6.5Aug 12 CVE-2026-649520.77.2	Medium6.5	0.77.2
Aug 12	Rapid7 Velociraptor: CSV injection Medium6.1Aug 12 CVE-2026-649550.77.2	Medium6.1	0.77.2
Aug 12	Rapid7 Velociraptor: missing authorization Medium6.5Aug 12 CVE-2026-186520.77.2	Medium6.5	0.77.2
Aug 12	Rapid7 Velociraptor: missing authorization High8.2Aug 12 CVE-2026-649540.77.2	High8.2	0.77.2
Aug 11	Rapid7 Velociraptor: null pointer dereference Medium6.5Aug 11 CVE-2026-186380.77.2	Medium6.5	0.77.2
Aug 11	Rapid7 Velociraptor: authentication bypass by spoofing High7.3Aug 11 CVE-2026-186390.77.2	High7.3	0.77.2
Aug 11	Rapid7 Velociraptor: path traversal High7.1Aug 11 CVE-2026-186400.77.2	High7.1	0.77.2
Aug 11	Rapid7 Velociraptor: improper authorization High7.2Aug 11 CVE-2026-186350.77.2	High7.2	0.77.2
Aug 11	Rapid7 Velociraptor: authentication bypass Medium6.8Aug 11 CVE-2026-186360.77.2	Medium6.8	0.77.2
Aug 11	Rapid7 Velociraptor: improper permission handling High8.7Aug 11 CVE-2026-188600.77.2	High8.7	0.77.2
Aug 11	Rapid7 Velociraptor: denial of service Medium6.2Aug 11 CVE-2026-175350.77.2	Medium6.2	0.77.2
Aug 11	Rapid7 Velociraptor: authentication bypass by spoofing Critical9.6Aug 11 CVE-2026-189720.77.2	Critical9.6	0.77.2
Aug 11	Rapid7 Velociraptor: missing authorization Medium4.1Aug 11 CVE-2026-183480.77.2	Medium4.1	0.77.2
Jul 24	Rapid7 Insight Agent: excessive privileges High7.8Jul 24 CVE-2026-14172InsightVM 1.1.3935+2 more	High7.8	InsightVM 1.1.3935+2 more

About Rapid7

Elsewhere on fru.dev: Quarterly · Paydays

Critical advisories by email