Known Vulnerabilities for Metasploit by Rapid7
Listed below are 10 of the newest known vulnerabilities associated with "Metasploit" by "Rapid7".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-109682 json | Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a differ... | Not Provided | 2026-10-21 | 2026-10-20 |
| CVE-2026-87690 json | The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerab... | Not Provided | 2026-10-12 | 2026-10-14 |
| CVE-2026-87689 json | The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServl... | Not Provided | 2026-10-13 | 2026-10-14 |
| CVE-2026-16895 json | A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interf... | Not Provided | 2026-08-27 | 2026-08-27 |
| CVE-2023-0599 json | Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of Jav... | 4.8 - MEDIUM | 2023-02-01 | 2023-11-07 |
| CVE-2020-7385 json | By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same de... | 8.8 - HIGH | 2021-04-23 | 2021-05-14 |
| CVE-2020-7384 json | Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a fil... | 7.8 - HIGH | 2020-10-29 | 2021-02-03 |
| CVE-2020-7377 json | The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path travers... | 7.5 - HIGH | 2020-08-24 | 2020-09-01 |
| CVE-2020-7376 json | The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in t... | 9.8 - CRITICAL | 2020-08-24 | 2020-09-02 |
| CVE-2020-7355 json | Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an a... | 6.1 - MEDIUM | 2020-06-25 | 2020-07-06 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Rapid7 | Metasploit | 6.0.3 | |||
| Application | Rapid7 | Metasploit | 6.0.2 | |||
| Application | Rapid7 | Metasploit | 6.0.1 | |||
| Application | Rapid7 | Metasploit | 6.0.0 | |||
| Application | Rapid7 | Metasploit | 5.0.99 | |||
| Application | Rapid7 | Metasploit | 5.0.98 | |||
| Application | Rapid7 | Metasploit | 5.0.97 | |||
| Application | Rapid7 | Metasploit | 5.0.96 | |||
| Application | Rapid7 | Metasploit | 5.0.95 | |||
| Application | Rapid7 | Metasploit | 5.0.94 | |||
| Application | Rapid7 | Metasploit | 5.0.93 | |||
| Application | Rapid7 | Metasploit | 5.0.92 | |||
| Application | Rapid7 | Metasploit | 5.0.91 | |||
| Application | Rapid7 | Metasploit | 5.0.90 | |||
| Application | Rapid7 | Metasploit | 5.0.9 | |||
| Application | Rapid7 | Metasploit | 5.0.89 | |||
| Application | Rapid7 | Metasploit | 5.0.88 | |||
| Application | Rapid7 | Metasploit | 5.0.87 | |||
| Application | Rapid7 | Metasploit | 5.0.86 | |||
| Application | Rapid7 | Metasploit | 5.0.85 |