CyberSecBulletin

Rapid7 vulnerabilities

We track 42 vulnerabilities in Rapid7 products across 28 products. 42 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.

42vulnerabilities
11critical
31high
0exploited
8.6average CVSS score

Latest Rapid7 vulnerabilities

  • 8.8 High severity

    Nexpose: Improper Neutralization of Special Elements used in an SQL Command

    CVE-2022-0757Rapid7EPSS 1.23%

    Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL Injection vulnerability, whereby valid search operators are not defined. This lack of validation can allow a logged-in, authenticated attacker to manipulate the "ANY" and "OR" operators in th

  • 7.8 High severity

    Insight Agent: Unquoted Search Path or Element

    CVE-2022-0237Rapid7

    Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in elev