Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
No EMERGENCY vulnerabilities this month.
15 vulnerabilities across 11 products scored HIGH or above on September 09, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 14 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin. [UPGRADED] CVE-2026-20212 (cisco/cisco_nx-os_software) — F1: theoretical → poc, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-02 bulletin. 🔴 [CRITICAL] parse-community/parse-server 1 CVE | CVSS 4.0: 9.1 | AAS 12.0 ...
331 vulnerabilities across 15 products scored HIGH or above on September 08, 2026. 🔴 CRITICAL: 4 🟠 HIGH: 327 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin. [UPGRADED] CVE-2026-20212 (cisco/cisco_nx-os_software) — F1: theoretical → poc, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-02 bulletin. 🔴 [CRITICAL] adobe/adobe_experience_manager_as_a_cloud_service 1 CVE | CVSS 3.1: 9.9 | AAS 13.1 ...
9 vulnerabilities across 6 products scored HIGH or above on September 07, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 8 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin. [UPGRADED] CVE-2026-20212 (cisco/cisco_nx-os_software) — F1: theoretical → poc, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-02 bulletin. 🔴 [CRITICAL] adobe/adobe_commerce 1 CVE | CVSS 3.1: 10.0 | AAS 14.1 ...
3 vulnerabilities across 3 products scored HIGH or above on September 06, 2026. 🟠 HIGH: 3 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin. 🟠 [HIGH] shabti/frontend_admin_by_dynamiapps 1 CVE | CVSS 3.1: 9.8 | AAS 10.9 cpe:2.3:a:shabti:frontend_admin_by_dynamiapps:*:*:*:*:*:*:*:* Frontend Admin by DynamiApps (WordPress Plugin) — Critical Authentication Bypass ...
17 vulnerabilities across 13 products scored HIGH or above on September 05, 2026. 🟠 HIGH: 17 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin. 🟠 [HIGH] coollabsio/coolify 1 CVE | CVSS 4.0: 9.2 | AAS 11.7 cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:* Coolify, the open-source self-hosting platform by coollabsio, is affected by one high-severity vulnerability (CVE-2026-86117, CVSS 9.2) in versions through 4.3.17. The flaw is an authentication bypass in the OAuth callback handler that allows an attacker to sign into any existing account by simply registering the victim’s email address on a supported OAuth provider, completely bypassing password and two-factor authentication controls. This vulnerability is considered exploitable and is relevant to any organization running a self-hosted Coolify instance with OAuth login enabled. ...
20 vulnerabilities across 15 products scored HIGH or above on September 04, 2026. 🟠 HIGH: 20 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin. 🟠 [HIGH] ibm/operational_decision_manager 1 CVE | CVSS 3.1: 9.8 | AAS 11.4 cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 8.11.0.1) cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 8.12.0.1) cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 9.0.0.1) cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 9.5.0.0) cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 9.6.0.0) IBM Operational Decision Manager versions 8.11.0.1 through 9.6.0.0 is affected by one critical vulnerability (CVE-2026-18658, CVSS 9.8) involving an unauthenticated SQL injection flaw that can be chained to achieve remote code execution via web shell deployment. Organizations using ODM for business rule automation should treat this as an urgent priority, as no authentication is required to exploit the issue and it provides full system compromise. ...
27 vulnerabilities across 15 products scored HIGH or above on September 03, 2026. 🟠 HIGH: 27 🟠 [HIGH] google/chrome 8 CVEs | CVSS 3.1: 9.6 | AAS 11.4 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (< 152.0.7977.82) Google Chrome is affected by eight vulnerabilities addressed in the latest stable channel update, including multiple high-severity issues. The most critical, rated CVSS 9.6, involves improper input validation in the Transactions Platform on iOS that could allow a remote attacker to execute arbitrary code outside the browser sandbox via a crafted HTML page. Additional flaws span multiple Chrome components and are considered exploitable. ...
21 vulnerabilities across 13 products scored HIGH or above on September 02, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 20 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin. 🔴 [CRITICAL] craftcms/cms 5 CVEs | CVSS 4.0: 9.2 | AAS 12.2 cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:* Craft CMS versions prior to 5.10.11 are affected by five vulnerabilities, including at least one rated CRITICAL with a CVSS 4.0 score of 9.2. The most severe issue allows attackers to gain full administrator privileges by registering with a deactivated admin’s email address, exploiting a flaw where the admin flag is not properly cleared during user registration. This is exploitable in environments where public registration is enabled and email verification is disabled. Security teams running Craft CMS should update to version 5.10.11 or later immediately and review the vendor advisory at the link above for details on all five issues. Organizations should also audit their Craft CMS instances for any unauthorized admin accounts that may have been created through this registration bypass. ...
25 vulnerabilities across 12 products scored HIGH or above on September 01, 2026. 🟠 HIGH: 25 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin. 🟠 [HIGH] predis/predis 1 CVE | CVSS 3.1: 9.8 | AAS 11.4 cpe:2.3:a:predis:predis:*:*:*:*:*:*:*:* (>= 3.0.0-RC1, < 3.3.0) Predis, a popular Redis and Valkey client library for PHP, is affected by one critical-severity vulnerability (CVE-2026-84372, CVSS 9.8). Versions 3.0.0-RC1 through 3.2.x contain a CRLF injection flaw in pipeline handling for aggregate cluster and replication connections, where attacker-controlled keys or values containing CRLF sequences can be interpreted as additional Redis commands due to improper parsing of serialized RESP buffers. This effectively allows command injection against the Redis backend and is considered exploitable. Any organization running Predis 3.0.0-RC1 or later in production should upgrade to version 3.3.0 immediately and review the vendor advisory at the linked GitHub commit for additional remediation details. ...
14 vulnerabilities across 11 products scored HIGH or above on August 31, 2026. 🟠 HIGH: 14 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin. 🟠 [HIGH] zhenorzz/goploy 1 CVE | CVSS 3.1: 9.6 | AAS 11.4 cpe:2.3:a:zhenorzz:goploy:*:*:*:*:*:*:*:* Goploy, an open-source automation deployment system by zhenorzz, is affected by one critical vulnerability (CVE-2026-53552, CVSS 9.6) involving broken access control across multiple API endpoints. The flaw allows a user with the manager role to manipulate projects outside their assigned namespace by supplying arbitrary project or file row IDs, because the backend fails to verify namespace ownership before acting on requests. A proof-of-concept exploit is publicly available. Organizations running Goploy version 1.17.5 or earlier should review the vendor advisory at the linked GitHub Security Advisory, apply any available patches or mitigations immediately, and audit project access logs for signs of unauthorized cross-namespace activity. ...