Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

Rapid7 Security Vulnerabilities | CyStack CVE Database

CVE	Exploitation status	Fix	Affected product	Published	Severity
`CVE-2026-19584`Velociraptor VQL injection during notebook restore from backup	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published09/10/2026	SeverityHigh
`CVE-2026-19583`Velociraptor Required Permissions bypass by using client monitoring queries	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published09/10/2026	SeverityCritical
`CVE-2026-16895`Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails	Exploitation statusNot known exploited	FixYes	Affected productMetasploit-framework	Published08/27/2026	SeverityMedium
`CVE-2026-19200`Velociraptor Analyst overwrites live built-in artifacts through verify()	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/24/2026	SeverityHigh
`CVE-2026-15371`Velociraptor Stored XSS in URL column types	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/18/2026	SeverityHigh
`CVE-2026-18652`Velociraptor STACK Type Download Path Bypasses Denied Prefix Check	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/12/2026	SeverityMedium
`CVE-2026-64951`Velociraptor DoS triggered by Divide by Zero panic	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/12/2026	SeverityLow
`CVE-2026-64952`Velociraptor Hunt Deletion With Insufficient Permission Check	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/12/2026	SeverityMedium
`CVE-2026-64955`Velociraptor CSV Formula Injection in Export Pipeline	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/12/2026	SeverityMedium
`CVE-2026-64954`Velociraptor collect_client() Permissions Bypass	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/12/2026	SeverityHigh
`CVE-2026-18639`Velociraptor OIDC Authenticator susceptible to email spoofing	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/11/2026	SeverityHigh
`CVE-2026-18638`Velociraptor server crash via the SetPassword API	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/11/2026	SeverityMedium
`CVE-2026-18640`Velociraptor directory traversal via the NewNotebook API	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/11/2026	SeverityHigh
`CVE-2026-18860`Velociraptor incorrect Org deletion permissions check	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/11/2026	SeverityHigh
`CVE-2026-17535`Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/11/2026	SeverityMedium
`CVE-2026-18636`Velociraptor VFSGetBuffer API path deny list bypass	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/11/2026	SeverityMedium
`CVE-2026-18635`Velociraptor query plugin allows impersonation in other orgs	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/11/2026	SeverityHigh
`CVE-2026-18972`Velociraptor authenticated identity-spoofing vulnerability	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/11/2026	SeverityCritical
`CVE-2026-18348`Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published08/11/2026	SeverityMedium
`CVE-2026-14172`Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation	Exploitation statusNot known exploited	FixYes	Affected productInsightVM	Published07/24/2026	SeverityHigh
`CVE-2026-8661`Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect Markdown Plugin	Published06/26/2026	SeverityMedium
`CVE-2026-8658`OS Command Injection in Rapid7 InsightConnect Tcpdump Plugin	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect Tcpdump Plugin	Published06/25/2026	SeverityMedium
`CVE-2026-8662`Path Traversal in Rapid7 InsightConnect Compression Plugin	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect Compression Plugin	Published06/25/2026	SeverityLow
`CVE-2026-8666`OS Command Injection in Rapid7 InsightConnect Traceroute Plugin	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect Traceroute Plugin	Published06/25/2026	SeverityHigh
`CVE-2026-8592`OS Command Injection in Rapid7 InsightConnect AWK Plugin	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect AWK Plugin	Published06/25/2026	SeverityHigh
`CVE-2026-8664`OS Command Injection in Rapid7 InsightConnect Finger Plugin	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect Finger Plugin	Published06/25/2026	SeverityMedium
`CVE-2026-8665`OS Command Injection in Rapid7 InsightConnect Translate Plugin	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect TR Plugin	Published06/25/2026	SeverityHigh
`CVE-2026-8660`OS Command Injection in Rapid7 InsightConnect Ping Plugin	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect Ping Plugin	Published06/25/2026	SeverityHigh
`CVE-2026-9153`Arbitrary File Read in Rapid7 InsightConnect Sed Plugin	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect Sed Plugin	Published06/25/2026	SeverityMedium
`CVE-2026-9154`Arbitrary File Write in Rapid7 InsightConnect Sed Plugin	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect Sed Plugin	Published06/25/2026	SeverityHigh
`CVE-2026-9155`OS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter.	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect Sed Plugin	Published06/25/2026	SeverityHigh
`CVE-2026-8659`OS Command Injection in Rapid7 InsightConnect SQLmap Plugin	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect SQLmap Plugin	Published06/25/2026	SeverityMedium
`CVE-2026-8663`OS Command Injection in Rapid7 InsightConnect RPM Plugin	Exploitation statusNot known exploited	FixYes	Affected productInsightConnect RPM Plugin	Published06/24/2026	SeverityMedium
`CVE-2026-8795`CVE-2026-8795	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published06/09/2026	SeverityHigh
`CVE-2026-7373`Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading	Exploitation statusNot known exploited	FixNot confirmed	Affected productMetasploit Pro	Published05/15/2026	SeverityHigh
`CVE-2026-6863`HTTP Filestore Endpoints Misapply Permissions Across Organizations	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published05/06/2026	SeverityMedium
`CVE-2026-7572`Velociraptor EVTX Parser — Process Crash via Crafted .evtx File	Exploitation statusNot known exploited	FixYes	Affected productvelociraptor	Published05/06/2026	SeverityMedium
`CVE-2026-7573`GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations	Exploitation statusNot known exploited	FixYes	Affected productvelociraptor	Published05/06/2026	SeverityMedium
`CVE-2026-6948`Unbounded Memory Allocation in VQLResponse Result-Set Writer	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published05/03/2026	SeverityMedium
`CVE-2026-6482`Local Privilege Escalation via OpenSSL configuration file in Insight Agent	Exploitation statusNot known exploited	FixYes	Affected productInsight Agent	Published04/17/2026	SeverityHigh
`CVE-2026-6290`Velociraptor Query() Plugin Misapplies Permissions To Orgs	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published04/15/2026	SeverityHigh
`CVE-2026-4482`Insight Agent Private Key Information Disclosure via Inherited File Permissions	Exploitation statusNot known exploited	FixYes	Affected productInsight Agent	Published04/10/2026	SeverityMedium
`CVE-2026-5329`Rapid7 Velociraptor Improper Input Validation in Client Message Handler	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published04/09/2026	SeverityHigh
`CVE-2026-4837`Eval Injection in Rapid7 Insight Agent	Exploitation statusNot known exploited	FixYes	Affected productInsight Agent	Published04/08/2026	SeverityMedium
`CVE-2026-1568`Rapid7 InsightVM Signature Validation Vulnerability	Exploitation statusNot known exploited	FixYes	Affected productVulnerability Management	Published02/03/2026	SeverityCritical
`CVE-2026-1814`Rapid7 Nexpose Insecure Java Keystore Password Generation	Exploitation statusPublic exploit	FixYes	Affected productInsightVM/Nexpose	Published02/03/2026	SeverityMedium
`CVE-2025-14728`Rapid7 Velociraptor Directory Traversal Vulnerability	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published12/29/2025	SeverityMedium
`CVE-2025-11195`Rapid7 AppSpider Project Name Validation Bypass	Exploitation statusNot known exploited	FixYes	Affected productAppSpider Pro	Published09/30/2025	SeverityLow
`CVE-2025-36857`Rapid7 Appspider Broken Access Control Vulnerability	Exploitation statusNot known exploited	FixYes	Affected productAppspider Pro	Published09/25/2025	SeverityLow
`CVE-2025-6264`Velociraptor priviledge escalation via UpdateConfig artifact	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published06/20/2025	SeverityMedium
`CVE-2025-4951`CVE-2025-4951	Exploitation statusNot known exploited	FixYes	Affected productAppSpider Pro	Published05/20/2025	SeverityMedium
`CVE-2025-0914`Velociraptor Shell Plugin Prevent_execve Bypass	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published02/27/2025	SeverityLow
`CVE-2024-11401`Rapid7 Insight Platform Privilege Escalation Vulnerability	Exploitation statusNot known exploited	FixYes	Affected productInsight Platform	Published12/11/2024	SeverityMedium
`CVE-2024-10526`Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published11/07/2024	SeverityHigh
`CVE-2024-8042`Rapid7 Insight Platform Unauthorized Empty Group Creation	Exploitation statusNot known exploited	FixYes	Affected productInsight Platform	Published09/09/2024	SeverityLow
`CVE-2024-6504`Rapid7 InsightVM Protection Mechanism Failure	Exploitation statusNot known exploited	FixYes	Affected productInsightVM	Published07/18/2024	SeverityMedium
`CVE-2024-3185`Rapid7 Insight Agent Sensitive Key Exposed To Local Users	Exploitation statusPublic exploit	FixYes	Affected productInsight Agent	Published04/23/2024	SeverityMedium
`CVE-2024-0394`Rapid7 Minerva Armor Privilege Escalation	Exploitation statusPublic exploit	FixYes	Affected productMinerva	Published04/03/2024	SeverityHigh
`CVE-2024-2745`Rapid7 InsightVM Sensitive Information Exposure via URL	Exploitation statusNot known exploited	FixYes	Affected productInsightVM	Published04/02/2024	SeverityLow
`CVE-2023-5950`Rapid7 Velociraptor Reflected XSS	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published11/06/2023	SeverityHigh
`CVE-2023-2273`Rapid7 Insight Agent Directory Traversal	Exploitation statusNot known exploited	FixYes	Affected productInsight Agent	Published04/26/2023	SeverityMedium
`CVE-2023-2226`Velociraptor crashes while parsing some malformed PE or OLE files.	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published04/21/2023	SeverityLow
`CVE-2023-1699`Rapid7 Nexpose Forced Browsing	Exploitation statusNot known exploited	FixYes	Affected productNexpose	Published03/30/2023	SeverityMedium
`CVE-2021-3844`Rapid7 InsightVM Insufficient Session Expiration	Exploitation statusNot known exploited	FixYes	Affected productInsightVM	Published03/24/2023	SeverityMedium
`CVE-2023-1306`Rapid7 InsightCloudSec resource.db() method access	Exploitation statusPublic exploit	FixYes	Affected productInsightCloudSec	Published03/21/2023	SeverityHigh
`CVE-2023-1305`Rapid7 InsightCloudSec box object access	Exploitation statusPublic exploit	FixYes	Affected productInsightCloudSec	Published03/21/2023	SeverityHigh
`CVE-2023-1304`Rapid7 InsightCloudSec getattr() method access	Exploitation statusPublic exploit	FixYes	Affected productInsightCloudSec	Published03/21/2023	SeverityHigh
`CVE-2023-0681`Rapid7 Nexpose Uncontrolled URL Redirect	Exploitation statusNot known exploited	FixYes	Affected productNexpose	Published03/20/2023	SeverityMedium
`CVE-2023-0599`Rapid7 Metasploit Pro Stored XSS	Exploitation statusNot known exploited	FixYes	Affected productMetasploit Pro	Published02/01/2023	SeverityMedium
`CVE-2022-3913`Rapid7 Nexpose Certificate Validation Issue	Exploitation statusNot known exploited	FixYes	Affected productNexpose	Published02/01/2023	SeverityMedium
`CVE-2023-0290`Rapid7 Velociraptor directory traversal in client ID parameter	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published01/18/2023	SeverityMedium
`CVE-2023-0242`Insufficient permission check in the VQL copy() function	Exploitation statusNot known exploited	FixYes	Affected productVelociraptor	Published01/18/2023	SeverityHigh
`CVE-2017-5242`Rapid7 Nexpose Virtual Appliance Duplicate SSH Host Key	Exploitation statusNot known exploited	FixYes	Affected productNexpose Virtual Appliance	Published01/12/2023	SeverityHigh
`CVE-2022-4261`Rapid7 Nexpose Update Validation Issue	Exploitation statusNot known exploited	FixYes	Affected productNexpose	Published12/07/2022	SeverityMedium
`CVE-2019-5641`Rapid7 InsightVM Information Disclosure after Logout	Exploitation statusNot known exploited	FixNot confirmed	Affected productInsightVM	Published09/21/2022	SeverityLow
`CVE-2022-35632`XSS in User Interface	Exploitation statusNot confirmed	FixYes	Affected productVelociraptor	Published07/29/2022	SeverityUnknown
`CVE-2022-35631`Filesystem race on temporary files	Exploitation statusNot confirmed	FixYes	Affected productVelociraptor	Published07/29/2022	SeverityUnknown
`CVE-2022-35630`Unsafe HTML Injection in Artifact Collection Report	Exploitation statusNot confirmed	FixYes	Affected productVelociraptor	Published07/29/2022	SeverityUnknown
`CVE-2022-35629`Velociraptor Client ID Spoofing	Exploitation statusNot confirmed	FixYes	Affected productVelociraptor	Published07/29/2022	SeverityUnknown
`CVE-2022-0758`Rapid7 Nexpose Reflected XSS	Exploitation statusNot confirmed	FixYes	Affected productNexpose	Published03/17/2022	SeverityLow
`CVE-2022-0757`Rapid7 Nexpose SQL Injection	Exploitation statusNot confirmed	FixYes	Affected productNexpose	Published03/17/2022	SeverityMedium
`CVE-2022-0237`Rapid7 Insight Agent Privilege Escalation	Exploitation statusNot confirmed	FixYes	Affected productInsight Agent	Published03/17/2022	SeverityMedium
`CVE-2021-4016`Rapid7 Insight Agent Improper Access Control	Exploitation statusNot confirmed	FixYes	Affected productInsight Agent	Published01/21/2022	SeverityMedium
`CVE-2021-4007`Rapid7 Insight Agent Privilege Escalation	Exploitation statusNot confirmed	FixYes	Affected productInsight Agent	Published12/14/2021	SeverityHigh
`CVE-2019-5640`Rapid7 Nexpose Information Disclosure after logout	Exploitation statusNot confirmed	FixYes	Affected productNexpose	Published11/22/2021	SeverityLow
`CVE-2021-31868`Rapid7 Nexpose Security Console Ticket Access Authentication Vulnerability	Exploitation statusNot confirmed	FixYes	Affected productNexpose	Published08/19/2021	SeverityMedium
`CVE-2021-3619`Rapid7 Velociraptor Notebooks Authenticated Persistent XSS	Exploitation statusNot confirmed	FixYes	Affected productVelociraptor	Published08/17/2021	SeverityLow
`CVE-2021-3535`CVE-2021-3535	Exploitation statusNot confirmed	FixYes	Affected productRapid7 Nexpose	Published06/16/2021	SeverityMedium
`CVE-2020-7385`Metasploit Framework 'drb_remote_codeexec' code execution	Exploitation statusNot confirmed	FixYes	Affected productMetasploit Framework	Published04/23/2021	SeverityHigh
`CVE-2020-7384`Client-Side Command Injection in Rapid7 Metasploit	Exploitation statusNot confirmed	FixYes	Affected productMetasploit	Published10/29/2020	SeverityHigh
`CVE-2020-7383`SQL Injection in Rapid7 Nexpose	Exploitation statusNot confirmed	FixYes	Affected productNexpose	Published10/14/2020	SeverityMedium
`CVE-2020-7358`Code Injection in Rapid7 AppSpider Pro Installer	Exploitation statusNot confirmed	FixYes	Affected productAppSpider	Published09/18/2020	SeverityMedium
`CVE-2020-7382`Unquoted Path in Rapid7 Nexpose Installer	Exploitation statusNot confirmed	FixYes	Affected productNexpose	Published09/03/2020	SeverityMedium
`CVE-2020-7381`Code Injection in Rapid7 Nexpose Installer	Exploitation statusNot confirmed	FixYes	Affected productNexpose	Published09/03/2020	SeverityMedium
`CVE-2019-5645`Rapid7 Metasploit HTTP Handler Denial of Service	Exploitation statusNot confirmed	FixNot confirmed	Affected productMetasploit Framework	Published09/01/2020	SeverityHigh
`CVE-2020-7377`Rapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump module	Exploitation statusNot confirmed	FixYes	Affected productMetasploit Framework	Published08/24/2020	SeverityHigh
`CVE-2020-7376`Rapid7 Metasploit Framework Relative Path Traversal in enum_osx module	Exploitation statusNot confirmed	FixYes	Affected productMetasploit Framework	Published08/24/2020	SeverityHigh
`CVE-2020-7355`Rapid7 Metasploit Pro Stored XSS in 'notes' field	Exploitation statusNot confirmed	FixYes	Affected productMetasploit Pro	Published06/25/2020	SeverityMedium
`CVE-2020-7354`Rapid7 Metasploit Pro Stored XSS in 'host' field	Exploitation statusNot confirmed	FixYes	Affected productMetasploit Pro	Published06/25/2020	SeverityMedium
`CVE-2020-7350`Metasploit Framework Plugin Libnotify Command Injection	Exploitation statusNot confirmed	FixYes	Affected productMetasploit Framework	Published04/22/2020	SeverityMedium