rapid7

Latest CVEs · RSS

• CVE-2026-93637 2026-10-14 · CVSS 3.7
  An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses thro
• CVE-2026-93635 2026-10-14 · CVSS 5.3
  LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains us
• CVE-2026-108065 2026-10-14 · CVSS 9.8
  SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unau
• CVE-2026-87689 2026-10-13 · CVSS 9.8
  The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route i
• CVE-2026-87690 2026-10-12 · CVSS 8.8
  The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpol
• CVE-2026-50055 2026-10-08 · CVSS 6.5
  A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send c
• CVE-2026-50054 2026-10-08 · CVSS 7.1
  An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local accou
• CVE-2026-10631 2026-10-08 · CVSS 6.5
  An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read c
• CVE-2026-78413 2026-10-05 · CVSS 5.5
  Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated p
• CVE-2026-78411 2026-10-05 · CVSS 6.5
  Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to
• CVE-2026-78412 2026-10-05 · CVSS 4.9
  Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the call
• CVE-2026-93647 2026-09-25 · CVSS 9.3
  An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS,
• CVE-2026-93643 2026-09-25 · CVSS 9.8
  When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsig
• CVE-2026-93642 2026-09-25 · CVSS 9.3
  An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the att
• CVE-2026-93641 2026-09-25 · CVSS 9.3
  An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the at
• CVE-2026-97228 2026-09-25 · CVSS 2.7
  Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/expo
• CVE-2026-89325 2026-09-24 · CVSS 7.8
  An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary
• CVE-2026-77798 2026-09-24 · CVSS 6.5
  Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management modul
• CVE-2026-77797 2026-09-24 · CVSS 3.6
  Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.
• CVE-2026-19072 2026-09-24 · CVSS 9.9
  Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field
• CVE-2026-19584 2026-09-10 · CVSS 7.7
  Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell c
• CVE-2026-19583 2026-09-10 · CVSS 9.9
  Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execu
• CVE-2026-16895 2026-08-27 · CVSS 5.1
  A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs durin
• CVE-2026-19200 2026-08-24 · CVSS 8.9
  The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, t
• CVE-2026-15371 2026-08-18 · CVSS 8.1
  Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.