How many CVEs does Rapid7 have?

Rapid7 has 162 published CVE records since 2013, including 36 in the last two years.

How many Rapid7 CVEs are in CISA KEV?

Yes — 8 of Rapid7's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Rapid7 products have the most CVEs?

The Rapid7 products with the most published CVEs are metasploit-framework, Nexpose, Velociraptor, Metasploit, InsightVM.

What are the most common weakness types in Rapid7 CVEs?

Rapid7's CVEs most often map to these CWE weakness types: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).

Are there public exploits for Rapid7 vulnerabilities?

Yes — 68 of Rapid7's CVEs have a known public exploit.

How many critical Rapid7 vulnerabilities are there?

Rapid7 has 39 critical and 69 high-severity CVEs.

What is the average severity of Rapid7 CVEs?

The average CVSS base score across Rapid7's scored CVEs is 7.6.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

162 CVEs

8 in CISA KEV

Rapid7 Vulnerabilities

Name: Rapid7 vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Rapid7.

162

Total CVEs

Published

8

In CISA KEV

Exploited in the wild

68

Public exploits

PoC or exploit code

7.6

Avg CVSS

2013–2026

Overview

Rapid7 has 162 published CVE records since 2013, of which 8 are in CISA's Known Exploited Vulnerabilities catalog and 68 have a known public exploit. The average CVSS base score across scored CVEs is 7.6.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Rapid7 products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Rapid7's vulnerability posture, as a share of its 162 published CVEs.

Average CVSS: 7.6
Critical / high: 67%
Actively exploited (KEV): 5%
Public exploit available: 42%
Patch available: 75%

Severity and exploitation

How the CVSS severity of Rapid7's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical39

High69

Medium47

Low7

In CISA’s Known Exploited Vulnerabilities catalog

8

8 of Rapid7's CVEs are confirmed exploited in the wild.

Public exploits

68

68 of Rapid7's CVEs have a known public exploit available.

Most affected products

The Rapid7 products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Rapid7 CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Rapid7 CVE records.

Disclosure activity by year

How many Rapid7 CVEs were published each year.

2019

9

2020

24

2021

7

2022

20

2023

16

2024

10

2025

9

2026

27

Latest Rapid7 CVEs

The most recently disclosed vulnerabilities affecting Rapid7.

Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin
CWE-79
Medium · CVSS 4.8
EPSS 0.3%2026-06-26
OS Command Injection in Rapid7 InsightConnect Tcpdump Plugin
CWE-78
High · CVSS 8.8
EPSS 0.8%2026-06-25
Path Traversal in Rapid7 InsightConnect Compression Plugin
CWE-22
Medium · CVSS 4.3
EPSS 0.2%2026-06-25
OS Command Injection in Rapid7 InsightConnect Traceroute Plugin
CWE-78
Critical · CVSS 9.8
EPSS 0.7%2026-06-25
OS Command Injection in Rapid7 InsightConnect AWK Plugin
CWE-78
Critical · CVSS 9.8
EPSS 0.7%2026-06-25
OS Command Injection in Rapid7 InsightConnect Finger Plugin
CWE-78
High · CVSS 8.8
EPSS 0.8%2026-06-25
OS Command Injection in Rapid7 InsightConnect Translate Plugin
CWE-78
Critical · CVSS 9.8
EPSS 0.7%2026-06-25
OS Command Injection in Rapid7 InsightConnect Ping Plugin
CWE-78
Critical · CVSS 9.8
EPSS 0.7%2026-06-25
Arbitrary File Read in Rapid7 InsightConnect Sed Plugin
CWE-22
Medium · CVSS 6.5
EPSS 0.3%2026-06-25
Arbitrary File Write in Rapid7 InsightConnect Sed Plugin
CWE-22
High · CVSS 7.1
EPSS 0.3%2026-06-25
OS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter.
CWE-78
High · CVSS 8.8
EPSS 0.9%2026-06-25
OS Command Injection in Rapid7 InsightConnect SQLmap Plugin
CWE-78
High · CVSS 8.8
EPSS 0.8%2026-06-25

Track new Rapid7 CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Rapid7 CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

djangoproject164 CVEs Concrete CMS163 CVEs CA Technologies162 CVEs OpenWrt162 CVEs cms_made_simple160 CVEs MIT160 CVEs MyBB160 CVEs wolfssl160 CVEs

Browse all vendors

Frequently asked questions

Common questions about Rapid7 vulnerabilities.

How many CVEs does Rapid7 have?: Rapid7 has 162 published CVE records since 2013, including 36 in the last two years.
How many Rapid7 CVEs are in CISA KEV?: Yes — 8 of Rapid7's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Rapid7 products have the most CVEs?: The Rapid7 products with the most published CVEs are metasploit-framework, Nexpose, Velociraptor, Metasploit, InsightVM.
What are the most common weakness types in Rapid7 CVEs?: Rapid7's CVEs most often map to these CWE weakness types: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).
Are there public exploits for Rapid7 vulnerabilities?: Yes — 68 of Rapid7's CVEs have a known public exploit.
How many critical Rapid7 vulnerabilities are there?: Rapid7 has 39 critical and 69 high-severity CVEs.
What is the average severity of Rapid7 CVEs?: The average CVSS base score across Rapid7's scored CVEs is 7.6.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Rapid7 vulnerabilities

Monitor new Rapid7 vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing