CVEs published by Rapid7, Inc.

CVEs published by Rapid7, Inc. (CVE Numbering Authority). 33 tracked.

• CVE-2026-93640 HIGH 7.8 A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS
• CVE-2026-50057 HIGH 7.8 A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix
• CVE-2026-50056 HIGH 7.8 A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) a
• CVE-2026-115785 MEDIUM 4.3 An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite
• CVE-2026-64954 HIGH 8.2 Velociraptor allows scheduling new collections via VQL queries in notebooks
• CVE-2026-64955 MEDIUM 6.1 When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, givi
• CVE-2026-64952 MEDIUM 6.5 The hunt_delete() VQL function allows deleting hunts.  Velociraptor misapplied the permission check requiring
• CVE-2026-18652 MEDIUM 6.5 Velociraptor allows reading Stacked result sets from the GUI.  Velociraptor's multi-tenant design stores sub o
• CVE-2026-64951 LOW 3.5 A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the fil
• CVE-2026-18972 CRITICAL 9.6 An authenticated attacker can spoof another GUI user's identity by sending their request with the custom heade
• CVE-2026-18860 HIGH 8.7 Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but us
• CVE-2026-18635 HIGH 7.2 Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context
• CVE-2026-18640 HIGH 7.1 The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK
• CVE-2026-18639 HIGH 7.3 When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username
• CVE-2026-18636 MEDIUM 6.8 The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore
• CVE-2026-18638 MEDIUM 6.5 Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire ser
• CVE-2026-17535 MEDIUM 6.2 Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be tr
• CVE-2026-18348 MEDIUM 4.1 Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticat
• CVE-2026-93639 HIGH 8.7 A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator wit
• CVE-2026-50053 HIGH 8.7 A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests
• CVE-2026-10632 HIGH 8.7 A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) a
• CVE-2026-93631 HIGH 7.1 A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network
• CVE-2026-93629 MEDIUM 5.3 An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email
• CVE-2026-93628 MEDIUM 5.3 An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS)
• CVE-2026-93627 MEDIUM 5.3 An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS)
• CVE-2026-115786 MEDIUM 6.5 A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to c
• CVE-2026-93638 MEDIUM 6.1 A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an
• CVE-2026-93633 MEDIUM 5.4 A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefca
• CVE-2026-93636 MEDIUM 4.3 An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to que
• CVE-2026-93634 MEDIUM 4.3 A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user t
• CVE-2026-93630 MEDIUM 4.3 A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) all
• CVE-2019-5645 HIGH 7.5 UPGRADE By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can
• CVE-2026-15371 HIGH 8.1 Velociraptor's web GUI allows specifying a custom type for columns in tables

← Back to latest CVEs