Vulnerabilities and Exploits

Explore the latest Rapid7 articles and research about Vulnerabilities and Exploits.

Latest articles about Vulnerabilities and Exploits

FortiGate CVE-2025-59718 Exploitation: Incident Response Findings

Eric Carey, Olivia Henderson, Noah Hemker

From Vectors to Verdicts: Web App Testing with Vector Command

CVE-2026-3055: Citrix NetScaler ADC and NetScaler Gateway Out-of-Bounds Read

CVE-2026-31381, CVE-2026-31382: Gainsight Assist Information Disclosure and Cross-Site Scripting (FIXED)

Christopher O’Boyle

Critical Cisco Catalyst Vulnerability Exploited in the wild (CVE-2026-20127)

Rapid7 Intelligence

The Phone is Listening: A Cold War–Style Vulnerability in Modern VoIP

Douglas McKee, Director, Vulnerability Intelligence

CVE-2026-2329: Critical Unauthenticated Stack Buffer Overflow in Grandstream GXP1600 VoIP Phones (FIXED)

CVE-2026-1731: Critical Unauthenticated Remote Code Execution in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)

Vulnerability Found in InsightVM & Nexpose: CVE-2026-1814 (FIXED)

Critical Ivanti Endpoint Manager Mobile (EPMM) zero-day exploited in the wild (CVE-2026-1281 & CVE-2026-1340)

Patch Tuesday and the Enduring Challenge of Windows’ Backwards Compatibility

Multiple Critical SolarWinds Web Help Desk Vulnerabilities: CVE-2025-40551, CVE-2025-40552, CVE-2025-40553, CVE-2025-40554

Ni8mare and N8scape flaws among multiple critical vulnerabilities affecting n8n

MongoBleed CVE-2025-14847: Critical Memory Leak in MongoDB Allowing Attackers to Extract Sensitive Data

CVE-2025-37164: Critical unauthenticated RCE affecting Hewlett Packard Enterprise OneView

Critical vulnerabilities in Fortinet CVE-2025-59718, CVE-2025-59719, CVE-2026-24858 exploited in the wild

Test for React2Shell with Application Security using New Functionality

New Research: Multifunction Printer (MFP) Security Concerns within the Enterprise Business Environment

Deral Heiland, Sam Moses

CVE-2025-10573: Ivanti EPM Unauthenticated Stored Cross-Site Scripting (Fixed)

React2Shell (CVE-2025-55182) - Critical unauthenticated RCE affecting React Server Components

CVE-2025-13315, CVE-2025-13316: Critical Twonky Server Authentication Bypass (NOT FIXED)