https://vulnogram.org/ Most recent CVEs assigned by Rapid7, Inc. (rapid7). https://vulnogram.org/seaview/icons/rapid7.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-109682 https://vulnogram.org/CVE-2026-109682 Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to mak… Medium Network Exploitable Tue, 20 Oct 2026 23:12:55 GMT https://vulnogram.org/CVE-2026-109681 https://vulnogram.org/CVE-2026-109681 The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to… Medium Network Exploitable Tue, 20 Oct 2026 23:11:51 GMT https://vulnogram.org/CVE-2026-107188 https://vulnogram.org/CVE-2026-107188 A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypa… Critical Mon, 19 Oct 2026 16:37:39 GMT https://vulnogram.org/CVE-2026-107187 https://vulnogram.org/CVE-2026-107187 A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authenti… High Mon, 19 Oct 2026 16:35:01 GMT https://vulnogram.org/CVE-2026-107186 https://vulnogram.org/CVE-2026-107186 An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication. High Network Exploitable Mon, 19 Oct 2026 16:32:05 GMT https://vulnogram.org/CVE-2026-93637 https://vulnogram.org/CVE-2026-93637 An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow… Low Network Exploitable Wed, 14 Oct 2026 16:25:23 GMT https://vulnogram.org/CVE-2026-93635 https://vulnogram.org/CVE-2026-93635 LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for… Medium Network Exploitable Wed, 14 Oct 2026 16:24:33 GMT https://vulnogram.org/CVE-2026-108065 https://vulnogram.org/CVE-2026-108065 SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backen… Critical Network Exploitable Wed, 14 Oct 2026 13:38:03 GMT https://vulnogram.org/CVE-2026-87689 https://vulnogram.org/CVE-2026-87689 The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_c… Critical Network Exploitable Tue, 13 Oct 2026 00:53:00 GMT https://vulnogram.org/CVE-2026-87690 https://vulnogram.org/CVE-2026-87690 The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a ho… High Network Exploitable Mon, 12 Oct 2026 04:50:56 GMT https://vulnogram.org/CVE-2026-50055 https://vulnogram.org/CVE-2026-50055 A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address. Medium Thu, 08 Oct 2026 16:25:42 GMT https://vulnogram.org/CVE-2026-50054 https://vulnogram.org/CVE-2026-50054 An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that s… High Thu, 08 Oct 2026 16:25:37 GMT https://vulnogram.org/CVE-2026-10631 https://vulnogram.org/CVE-2026-10631 An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts w… Medium Thu, 08 Oct 2026 16:25:27 GMT https://vulnogram.org/CVE-2026-78413 https://vulnogram.org/CVE-2026-78413 Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to r… Medium Mon, 05 Oct 2026 17:48:03 GMT https://vulnogram.org/CVE-2026-78411 https://vulnogram.org/CVE-2026-78411 Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration… Medium Mon, 05 Oct 2026 17:19:26 GMT https://vulnogram.org/CVE-2026-78412 https://vulnogram.org/CVE-2026-78412 Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to re… Medium Mon, 05 Oct 2026 16:51:34 GMT https://vulnogram.org/CVE-2026-93647 https://vulnogram.org/CVE-2026-93647 An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim. Critical Network Exploitable Fri, 25 Sep 2026 13:58:05 GMT https://vulnogram.org/CVE-2026-93643 https://vulnogram.org/CVE-2026-93643 When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra. Critical Network Exploitable Fri, 25 Sep 2026 13:57:19 GMT https://vulnogram.org/CVE-2026-93642 https://vulnogram.org/CVE-2026-93642 An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim. Critical Network Exploitable Fri, 25 Sep 2026 13:56:04 GMT https://vulnogram.org/CVE-2026-93641 https://vulnogram.org/CVE-2026-93641 An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim. Critical Network Exploitable Fri, 25 Sep 2026 13:55:10 GMT https://vulnogram.org/CVE-2026-97228 https://vulnogram.org/CVE-2026-97228 Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argument reaching… Low Fri, 25 Sep 2026 10:25:43 GMT https://vulnogram.org/CVE-2026-89325 https://vulnogram.org/CVE-2026-89325 An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Assessment content… High Thu, 24 Sep 2026 18:58:25 GMT https://vulnogram.org/CVE-2026-77798 https://vulnogram.org/CVE-2026-77798 Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module. Medium Thu, 24 Sep 2026 13:50:40 GMT https://vulnogram.org/CVE-2026-77797 https://vulnogram.org/CVE-2026-77797 Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files. Low Thu, 24 Sep 2026 13:49:41 GMT https://vulnogram.org/CVE-2026-19072 https://vulnogram.org/CVE-2026-19072 Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_collector_args" is an internal field, Velociraptor allowed the field to be set f… Critical Thu, 24 Sep 2026 12:52:51 GMT https://vulnogram.org/CVE-2026-19584 https://vulnogram.org/CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user wi… High Thu, 10 Sep 2026 03:00:00 GMT https://vulnogram.org/CVE-2026-19583 https://vulnogram.org/CVE-2026-19583 Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such… Critical Thu, 10 Sep 2026 02:58:11 GMT https://vulnogram.org/CVE-2026-16895 https://vulnogram.org/CVE-2026-16895 A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSF_WS_JSON_RPC_API_TO… Medium Thu, 27 Aug 2026 03:14:21 GMT https://vulnogram.org/CVE-2026-19200 https://vulnogram.org/CVE-2026-19200 The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts… High Mon, 24 Aug 2026 03:22:14 GMT https://vulnogram.org/CVE-2026-15371 https://vulnogram.org/CVE-2026-15371 Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify… High Tue, 18 Aug 2026 06:52:28 GMT https://vulnogram.org/CVE-2026-18652 https://vulnogram.org/CVE-2026-18652 Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets… Medium Wed, 12 Aug 2026 09:56:10 GMT https://vulnogram.org/CVE-2026-64951 https://vulnogram.org/CVE-2026-64951 A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process. The problem is a Divide by Zero bug in the ShouldPadFile() function. Low Wed, 12 Aug 2026 09:49:25 GMT https://vulnogram.org/CVE-2026-64952 https://vulnogram.org/CVE-2026-64952 The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "admin… Medium Wed, 12 Aug 2026 09:44:53 GMT https://vulnogram.org/CVE-2026-64955 https://vulnogram.org/CVE-2026-64955 When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI,… Medium Network Exploitable Wed, 12 Aug 2026 09:39:26 GMT https://vulnogram.org/CVE-2026-64954 https://vulnogram.org/CVE-2026-64954 Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authori… High Wed, 12 Aug 2026 04:26:32 GMT https://vulnogram.org/CVE-2026-18639 https://vulnogram.org/CVE-2026-18639 When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not act… High Tue, 11 Aug 2026 15:05:42 GMT https://vulnogram.org/CVE-2026-18638 https://vulnogram.org/CVE-2026-18638 Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist. Medium Tue, 11 Aug 2026 15:00:53 GMT https://vulnogram.org/CVE-2026-18640 https://vulnogram.org/CVE-2026-18640 The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db"… High Tue, 11 Aug 2026 14:53:18 GMT https://vulnogram.org/CVE-2026-18860 https://vulnogram.org/CVE-2026-18860 Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Vel… High Tue, 11 Aug 2026 14:52:55 GMT https://vulnogram.org/CVE-2026-17535 https://vulnogram.org/CVE-2026-17535 Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity… Medium Tue, 11 Aug 2026 14:47:13 GMT https://vulnogram.org/CVE-2026-18636 https://vulnogram.org/CVE-2026-18636 The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This p… Medium Tue, 11 Aug 2026 14:40:12 GMT https://vulnogram.org/CVE-2026-18635 https://vulnogram.org/CVE-2026-18635 Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velo… High Tue, 11 Aug 2026 14:15:58 GMT https://vulnogram.org/CVE-2026-18972 https://vulnogram.org/CVE-2026-18972 An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator. Critical Tue, 11 Aug 2026 12:30:52 GMT https://vulnogram.org/CVE-2026-18348 https://vulnogram.org/CVE-2026-18348 Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL p… Medium Tue, 11 Aug 2026 05:37:11 GMT https://vulnogram.org/CVE-2026-14172 https://vulnogram.org/CVE-2026-14172 Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM… High Fri, 24 Jul 2026 05:51:14 GMT https://vulnogram.org/CVE-2026-8661 https://vulnogram.org/CVE-2026-8661 Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers to make arbitrary outbound HTTP requests via unsanitized resource-loading HTML elements (im… Medium Network Exploitable Fri, 26 Jun 2026 01:59:58 GMT https://vulnogram.org/CVE-2026-8658 https://vulnogram.org/CVE-2026-8658 OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the options or filter parameters due to insufficient input sanitization in shell command construct… Medium Thu, 25 Jun 2026 01:56:51 GMT https://vulnogram.org/CVE-2026-8662 https://vulnogram.org/CVE-2026-8662 Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as… Low Thu, 25 Jun 2026 01:51:33 GMT https://vulnogram.org/CVE-2026-8666 https://vulnogram.org/CVE-2026-8666 OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insuffi… High Network Exploitable Thu, 25 Jun 2026 01:35:49 GMT https://vulnogram.org/CVE-2026-8592 https://vulnogram.org/CVE-2026-8592 OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in th… High Network Exploitable Thu, 25 Jun 2026 01:32:22 GMT