Advisories · Technology

Rapid7 Nexpose.

Every CVE that names Rapid7 Nexpose among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-14172 CVE record

CVSS 7.8 High

Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
- Rapid7 InsightVM
- Rapid7 Nexpose
- Privilege escalation
Not analysed yet 24 Jul 2026
CVE-2023-1699 CVE record

CVSS 4.3 Medium

Rapid7 Nexpose Forced Browsing
- Rapid7 Nexpose
- Broken access control
Not analysed yet 30 Mar 2023
CVE-2023-0681 CVE record

CVSS 4.3 Medium

Rapid7 Nexpose Uncontrolled URL Redirect
- Rapid7 Nexpose
- Open redirect
Not analysed yet 20 Mar 2023
CVE-2022-3913 CVE record

CVSS 5.3 Medium

Rapid7 Nexpose Certificate Validation Issue
- Rapid7 Nexpose
- Rapid7 InsightVM
- Weak cryptography or TLS
Not analysed yet 1 Feb 2023
CVE-2022-4261 CVE record

CVSS 4.4 Medium

Rapid7 Nexpose Update Validation Issue
- Rapid7 Nexpose
- Rapid7 InsightVM
- CWE-494
Not analysed yet 7 Dec 2022
CVE-2022-0758 CVE record

CVSS 3.3 Low

Rapid7 Nexpose Reflected XSS
- Rapid7 Nexpose
- Cross-site scripting (XSS)
Not analysed yet 17 Mar 2022
CVE-2022-0757 CVE record

CVSS 5.5 Medium

Rapid7 Nexpose SQL Injection
- Rapid7 Nexpose
- SQL injection
Not analysed yet 17 Mar 2022
CVE-2019-5640 CVE record

CVSS 3.3 Low

Rapid7 Nexpose Information Disclosure after logout
- Rapid7 Nexpose
- Information disclosure
Not analysed yet 22 Nov 2021
CVE-2021-31868 CVE record

CVSS 4.3 Medium

Rapid7 Nexpose Security Console Ticket Access Authentication Vulnerability
- Rapid7 Nexpose
- Authentication bypass
Not analysed yet 19 Aug 2021
CVE-2021-3535 CVE record

CVSS 4.3 Medium

Cross-site scripting in Rapid7 Nexpose
- Rapid7 Nexpose
- Cross-site scripting (XSS)
Not analysed yet 16 Jun 2021
CVE-2020-7383 CVE record

CVSS 6.5 Medium

SQL Injection in Rapid7 Nexpose
- Rapid7 Nexpose
- SQL injection
Not analysed yet 14 Oct 2020
CVE-2020-7382 CVE record

CVSS 6.8 Medium

Unquoted Path in Rapid7 Nexpose Installer
- Rapid7 Nexpose
- CWE-428
Not analysed yet 3 Sept 2020
CVE-2020-7381 CVE record

CVSS 5.8 Medium

Code Injection in Rapid7 Nexpose Installer
- Rapid7 Nexpose
- Code injection
Not analysed yet 3 Sept 2020
CVE-2019-5638 CVE record

CVSS 8.7 High

Rapid7 Nexpose Insufficient Session Management
- Rapid7 Nexpose
- Authentication bypass
Not analysed yet 21 Aug 2019
CVE-2017-5264 CVE record

Cross-site request forgery in Rapid7 Nexpose
- Rapid7 Nexpose
- Cross-site request forgery (CSRF)
Not analysed yet 14 Dec 2017
CVE-2017-5232 CVE record

Rapid7 Nexpose: All editions of Rapid7 Nexpose installers prior to version 6.4.24 contain a DLL…
- Rapid7 Nexpose
Not analysed yet 2 Mar 2017
CVE-2017-5230 CVE record

Rapid7 Nexpose: The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is…
- Rapid7 Nexpose
Not analysed yet 2 Mar 2017
CVE-2016-9757 CVE record

Rapid7 Nexpose: In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface…
- Rapid7 Nexpose
Not analysed yet 20 Dec 2016