Aretiq AI
We do vulnerability research on binaries and source code. This site has our technical write-ups on patched vulnerabilities, the advisories for issues we reported to vendors, and daily vulnerability bulletins.
Bulletins
Daily bulletins for the last three days. Checked hourly for new vulnerabilities.
Bulletin for Saturday, 10 October 2026
10 vulnerabilities across 10 products rated HIGH or above. Most severe: Miniorange Otp Verification.
Bulletin for Friday, 9 October 2026
19 vulnerabilities across 12 products rated HIGH or above. Most severe: 0xjacky/Nginx-UI.
Bulletin for Thursday, 8 October 2026
16 vulnerabilities across 10 products rated HIGH or above. Most severe: Ollama.
Research
Analysis of patched vulnerabilities: root cause, patch diff, detection, and proof-of-concept.
CVE-2026-15748
WPMU DEV Forminator Forms Select Field Injection Unrestricted File Upload
1. Overview A vulnerability exists in WPMU DEV’s Forminator Forms plugin for WordPress (600,000+ active installations) that allows …
18 Aug 2026
CVE-2026-61967
miniOrange OTP Verification Ultimate Member Password Reset Authentication Bypass
1. Overview A vulnerability exists in the miniOrange OTP Verification plugin for WordPress (versions 5.5.1 and earlier) that allows an …
15 Aug 2026
CVE-2026-54995
Microsoft Windows Reliable Multicast Transport Driver Integer Underflow
1. Overview A vulnerability exists in the Windows Reliable Multicast Transport Driver (rmcast.sys) that implements the Pragmatic General …
2 Jul 2026
CVE-2026-45502
Microsoft Exchange Server EWS InstallApp Server-Side Request Forgery
1. Overview A server-side request forgery (SSRF) vulnerability exists in Microsoft Exchange Server’s Exchange Web Services (EWS) …
22 Jun 2026
Discoveries
Vulnerabilities we reported to vendors. Advisories are published after a fix is available. See the Disclosure Policy.
CVE-2026-62801
Windows PowerShell Security Feature Bypass
Summary A path traversal vulnerability in Windows PowerShell allows an unauthenticated attacker to bypass path validation safeguards over a …
8 Sep 2026
CVE-2026-69364
Windows Print Spooler Components Elevation of Privilege
Summary A race condition in the Windows Print Spooler service leads to a use-after-free that allows an authenticated attacker to escalate …
8 Sep 2026
CVE-2026-62912
Microsoft Exchange Server Deserialization Denial of Service
Summary A deserialization of untrusted data vulnerability in Microsoft Exchange Server allows any user with a mailbox account to crash the …
11 Aug 2026
Contact
Email business@aretiq.ai, or use the contact form.