Advisoriesby Ibis

AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Rapid7 security advisories

27 advisories · 13 critical or high in 12 months · latest Oct 21

Advisories page

27 advisories

Medium 4.7Oct 21

Rapid7 Metasploit Framework: server-side request forgeryCVE-2026-109682fixed in 6.5.7 Medium 4.7Oct 21

Rapid7 Metasploit Framework: server-side request forgeryCVE-2026-109681fixed in 6.5.7 Low 2.7Sep 25

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query...CVE-2026-97228fixed in 0.6.2 High 7.8Sep 24

Rapid7 Insight Agent: code executionCVE-2026-89325no fix yet Low 3.6Sep 24

Rapid7 Velociraptor: improper input validationCVE-2026-77797fixed in 0.77.3 Medium 6.5Sep 24

Velociraptor contains a deadlock conditionCVE-2026-77798fixed in 0.77.2 Critical 9.9Sep 24

Velociraptor stores the compiled VQL in the hunt object internally to avoid...CVE-2026-19072fixed in 0.77.2 High 7.7Sep 10

Rapid7 Velociraptor: code injectionCVE-2026-19584fixed in 0.77.2 Critical 9.9Sep 10

Rapid7 Velociraptor: insecure permissionsCVE-2026-19583fixed in 0.77.2 Medium 5.1Aug 27

A logic vulnerabilityCVE-2026-16895fixed in 6.5.2 High 8.9Aug 24

Rapid7 Velociraptor: code injectionCVE-2026-19200fixed in 0.77.2 High 8.1Aug 18

Rapid7 Velociraptor: cross-site scriptingCVE-2026-15371fixed in 0.77.2 Low 3.5Aug 12

A rogue Velociraptor client can upload a malformed sparse file suchCVE-2026-64951fixed in 0.77.2 Medium 6.5Aug 12

Rapid7 Velociraptor: improper authorizationCVE-2026-64952fixed in 0.77.2 Medium 6.1Aug 12

Rapid7 Velociraptor: CSV injectionCVE-2026-64955fixed in 0.77.2 Medium 6.5Aug 12

Rapid7 Velociraptor: missing authorizationCVE-2026-18652fixed in 0.77.2 High 8.2Aug 12

Rapid7 Velociraptor: missing authorizationCVE-2026-64954fixed in 0.77.2 Medium 6.5Aug 11

Rapid7 Velociraptor: null pointer dereferenceCVE-2026-18638fixed in 0.77.2 High 7.3Aug 11

Rapid7 Velociraptor: authentication bypass by spoofingCVE-2026-18639fixed in 0.77.2 High 7.1Aug 11

Rapid7 Velociraptor: path traversalCVE-2026-18640fixed in 0.77.2 High 7.2Aug 11

Rapid7 Velociraptor: improper authorizationCVE-2026-18635fixed in 0.77.2 Medium 6.8Aug 11

Rapid7 Velociraptor: authentication bypassCVE-2026-18636fixed in 0.77.2 High 8.7Aug 11

Rapid7 Velociraptor: improper permission handlingCVE-2026-18860fixed in 0.77.2 Medium 6.2Aug 11

Rapid7 Velociraptor: denial of serviceCVE-2026-17535fixed in 0.77.2 Critical 9.6Aug 11

Rapid7 Velociraptor: authentication bypass by spoofingCVE-2026-18972fixed in 0.77.2 Medium 4.1Aug 11

Rapid7 Velociraptor: missing authorizationCVE-2026-18348fixed in 0.77.2 High 7.8Jul 24

Rapid7 Insight Agent: excessive privilegesCVE-2026-14172fixed in InsightVM 1.1.3935 +2

About Rapid7

Security advisories Rapid7 publishes for its own products.

www.rapid7.com/db Rapid7

Rapid7 elsewhere on Ibis: Quarterly · Paydays