100
CVEs
8
Critical
49
High
0
KEV
19
PoC
32
Unpatched C/H
42.0%
Patch Rate
1.0%
Avg EPSS
Severity Breakdown
CRITICAL
8
HIGH
49
MEDIUM
37
LOW
6
Monthly CVE Trend
Affected Products (30)
Velociraptor
27
Nexpose
18
Metasploit
15
Insight Agent
8
Appspider Pro
6
Insightvm
6
Insightappsec
4
Insightconnect Sed Plugin
3
Python
3
Insightcloudsec
3
OpenSSL
2
Insightconnect Finger Plugin
1
Insight Platform
1
Insightconnect Sqlmap Plugin
1
Insightconnect Tcpdump Plugin
1
Java
1
SSH
1
Insightconnect Ping Plugin
1
Metasploit Pro
1
Insightconnect Markdown Plugin
1
Insightconnect Compression Plugin
1
Insightconnect Rpm Plugin
1
Insightconnect Tr Plugin
1
Open Redirect
1
Insight Collector
1
Insightconnect Awk Plugin
1
PostgreSQL
1
Appspider
1
Komand
1
Ssti
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2020-7350 | Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 4.9% | 74 |
PoC
No patch
|
| CVE-2020-7384 | Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 30.6% | 74 |
PoC
No patch
|
| CVE-2020-7376 | The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can be exploited to write arbitrary files to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.1% | 69 |
PoC
No patch
|
| CVE-2017-5264 | Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.3% | 64 |
PoC
No patch
|
| CVE-2023-1304 | An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 1.1% | 64 |
PoC
No patch
|
| CVE-2023-1306 | An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 1.2% | 64 |
PoC
No patch
|
| CVE-2026-64954 | Privilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIENT permission check and schedule new client collections, a capability normally restricted to the investigator role. The bypass is achieved by executing a VQL query that resets the authorization provider, collapsing the RBAC boundary between analyst and investigator roles. No public exploit has been identified at time of analysis, though the remediation commit is publicly visible on GitHub. | HIGH | 8.2 | 23.0% | 64 |
|
| CVE-2023-1305 | An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.1 | 0.8% | 60 |
PoC
No patch
|
| CVE-2019-5629 | Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.9% | 59 |
PoC
No patch
|
| CVE-2022-0237 | Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.5% | 59 |
PoC
No patch
|
| CVE-2020-7377 | The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 1.1% | 58 |
PoC
No patch
|
| CVE-2019-5624 | Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.3 | 2.8% | 56 |
PoC
No patch
|
| CVE-2012-6493 | Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available. | MEDIUM | 6.8 | 0.4% | 54 |
PoC
|
| CVE-2017-15084 | The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 0.1% | 53 |
PoC
No patch
|
| CVE-2022-4261 | Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 0.3% | 52 |
PoC
No patch
|