Rapid7 Metasploit vulnerabilities

• rapid7 metasploit framework Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authentication CVE-2026-121139 7.3 HighNovember 5, 2026
• rapid7 metasploit framework Metasploit Framework HTTP Redirect Server-Side Request Forgery CVE-2026-109682 4.7 MediumOctober 20, 2026
• rapid7 metasploit framework Metasploit Framework FTP PASV Response SSRF CVE-2026-109681 4.7 MediumOctober 20, 2026
• rapid7 metasploit framework Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints CVE-2026-87689 9.8 CriticalOctober 13, 2026
• rapid7 metasploit framework Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution CVE-2026-87690 Public exploit 8.8 HighOctober 12, 2026
• rapid7 metasploit-framework Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails CVE-2026-16895 5.1 MediumAugust 27, 2026
• rapid7 metasploit pro Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading CVE-2026-7373 8.5 HighMay 15, 2026
• rapid7 metasploit, metasploit pro +1 more Rapid7 Metasploit Pro Stored XSS CVE-2023-0599 6.1 MediumFebruary 1, 2023
• rapid7 metasploit, metasploit framework +1 more Metasploit Framework 'drb_remote_codeexec' code execution CVE-2020-7385 Fix available 8.1 HighApril 23, 2021
• rapid7 metasploit Client-Side Command Injection in Rapid7 Metasploit CVE-2020-7384 Public exploit EPSS 30.5% 7.0 HighOctober 29, 2020
• rapid7 metasploit, metasploit framework +1 more Rapid7 Metasploit HTTP Handler Denial of Service CVE-2019-5645 EPSS 49.2% 7.5 HighSeptember 1, 2020
• rapid7 metasploit, metasploit framework +1 more Rapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump module CVE-2020-7377 8.1 HighAugust 24, 2020
• rapid7 metasploit, metasploit framework +1 more Rapid7 Metasploit Framework Relative Path Traversal in enum_osx module CVE-2020-7376 7.1 HighAugust 24, 2020
• rapid7 metasploit, metasploit pro +1 more Rapid7 Metasploit Pro Stored XSS in 'notes' field CVE-2020-7355 6.1 MediumJune 25, 2020
• rapid7 metasploit, metasploit pro +1 more Rapid7 Metasploit Pro Stored XSS in 'host' field CVE-2020-7354 6.1 MediumJune 25, 2020
• rapid7 metasploit, metasploit framework +1 more Metasploit Framework Plugin Libnotify Command Injection CVE-2020-7350 Public exploit 6.1 MediumApril 22, 2020
• rapid7 metasploit, metasploit pro +1 more MAGICK CVE-2019-5642 3.3 LowNovember 6, 2019
• rapid7 metasploit, metasploit framework +1 more Rapid7 Metasploit Framework Zip Import Directory Traversal CVE-2019-5624 Public exploit 7.4 HighApril 30, 2019
• rapid7 metasploit The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22. CVE-2017-15084 Public exploit 6.5 MediumOctober 6, 2017
• rapid7 metasploit, metasploit (pro, express, and community editions) +1 more Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET... CVE-2017-5244 3.5 LowJune 15, 2017
• rapid7 metasploit, metasploit pro +1 more Rapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading... CVE-2017-5235 7.8 HighMarch 2, 2017
• rapid7 metasploit All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory... CVE-2017-5231 7.1 HighMarch 2, 2017
• rapid7 metasploit All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory... CVE-2017-5229 7.1 HighMarch 2, 2017
• rapid7 metasploit All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory... CVE-2017-5228 7.1 HighMarch 2, 2017