CVE-2026-88804

Critical Rancher XSS Vulnerability Exposes Admin Credentials Diagram explaining the Rancher XSS vulnerability and CVE-2026-88804 attack chain

Critical Rancher XSS Vulnerability Exposes Admin Credentials

Do Son September 24, 2026

TL;DR On September 24, 2026, SUSE addressed a severe stored cross-site scripting flaw in its container management...

📧

Email Delivery
Get threat intel straight to your inbox.

♾️

Unlimited Vendors
Track every technology in your stack.

🚨

All New CVE Alerts
Be the first to know about new flaws.

⚙️

Custom EPSS Threshold
Filter noise, focus on real risks.

💬

Slack & Teams Webhook
Integrate directly into your SecOps.

🚫

100% Ad-Free
Enjoy an uninterrupted reading experience.

$7/mo

CVE-2026-48842CVSS 8.1
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via...
Admin intel📅 Updated: Sep 23, 2026
CVE-2026-87902
Unauthenticated path traversal in page-template resolution leading to conditional RCE An unauthenticated attacker can make get_page_template() page-template resolution...
Admin intel📅 Updated: Sep 23, 2026
CVE-2026-94127CVSS 9.8
When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious...
Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026
CVE-2026-85102CVSS 9.8
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote...
Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026
CVE-2026-93616CVSS 9.8
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on...
Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026
CVE-2026-93952CVSS 10.0
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access...
Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026
CVE-2026-32996CVSS 7.3
A vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
Admin intel📅 Updated: Sep 22, 2026
CVE-2026-7273CVSS 8.8
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a...
CISA KEV📅 Added to KEV: Sep 21, 2026

CVE-2026-84502CVSS 9.9
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not...
📅 Updated: Sep 24, 2026
CVE-2026-84719CVSS 9.9
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission...
📅 Updated: Sep 24, 2026
CVE-2026-84474CVSS 9.9
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed...
📅 Updated: Sep 24, 2026
CVE-2026-75884CVSS 9.1
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts...
📅 Updated: Sep 24, 2026
CVE-2026-12564CVSS 9.6
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads...
📅 Updated: Sep 24, 2026
CVE-2026-86708CVSS 10.0
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private...
📅 Updated: Sep 24, 2026
CVE-2026-76578CVSS 9.8
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not...
📅 Updated: Sep 24, 2026
CVE-2026-71290CVSS 9.1
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used...
📅 Updated: Sep 24, 2026

Critical Alert 4 Active Exploits Detected Today

Critical Rancher XSS Vulnerability Exposes Admin Credentials