Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
8 vulnerabilities across 5 products scored HIGH or above on August 24, 2026. 🟠 HIGH: 8 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-72843 (evershopcommerce/evershop) — F1: exploitable → functional, AAS: 10.2 → 12.2 (HIGH → CRITICAL). Originally in 2026-08-20 bulletin. 🟠 [HIGH] canonical/lxd 1 CVE | CVSS 3.1: 9.9 | AAS 11.1 cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:* Failed to authenticate: OAuth session expired and could not be refreshed ...
1 vulnerability across 1 product scored HIGH or above on August 23, 2026. 🟠 HIGH: 1 🟠 [HIGH] ongres/stackgres 1 CVE | CVSS 3.1: 9.9 | AAS 10.2 cpe:2.3:a:ongres:stackgres:*:*:*:*:*:*:*:* Failed to authenticate: OAuth session expired and could not be refreshed 🟠 CVE-2026-78155 (CVSS 3.1: 9.9) Vendor Advisory
14 vulnerabilities across 7 products scored HIGH or above on August 22, 2026. 🟠 HIGH: 14 🟠 [HIGH] netty/netty 1 CVE | CVSS 4.0: 8.7 | AAS 10.6 cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* (< 4.1.137.final) cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* (>= 4.2.0.final, < 4.2.17.final) Netty has one high-severity vulnerability (CVE-2026-62243, CVSS 8.7) affecting netty-handler versions 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final. The flaw disables TLS hostname verification on the OpenSSL client path when a plain X509TrustManager is used and unsafe-based trust-manager wrapping is unavailable, such as on Java 25 and later. This allows a man-in-the-middle attacker to present a certificate for a different hostname and have it accepted, undermining the confidentiality and integrity of encrypted connections. Teams running Netty-based services or clients with OpenSSL TLS providers should upgrade immediately and consult the vendor advisory at the linked GitHub security page for patched versions and mitigation guidance. ...
26 vulnerabilities across 15 products scored HIGH or above on August 21, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 25 🔴 [CRITICAL] spip/spip 1 CVE | CVSS 3.1: 9.8 | AAS 13.9 cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:* SPIP — Critical Remote Code Execution (Exploited in the Wild) SPIP, the open-source content management and publishing system, is affected by one critical vulnerability (CVE-2026-77806, CVSS 9.8) that allows unauthenticated remote attackers to execute arbitrary code via crafted X-Spip-Filtre HTTP request headers due to improper handling in the template analysis function. This vulnerability is actively being exploited in the wild as of August 2026. All organizations running SPIP versions prior to 4.4.21 should treat this as an emergency and upgrade immediately by following the guidance in the vendor’s security advisory at blog.spip.net. ...
44 vulnerabilities across 15 products scored HIGH or above on August 20, 2026. 🔴 CRITICAL: 2 🟠 HIGH: 42 🔴 [CRITICAL] spip/spip 1 CVE | CVSS 3.1: 9.8 | AAS 13.9 cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:* (< 4.4.20) SPIP — Critical Remote Code Execution Exploited in the Wild SPIP versions prior to 4.4.20 are affected by a critical unauthenticated remote code execution vulnerability (CVE-2026-77647, CVSS 9.8). The flaw stems from incorrect handling of PHP code blocks and unsafe use of var_export, allowing remote attackers to execute arbitrary code without authentication. This vulnerability is confirmed to be actively exploited in the wild as of August 2026. All organizations running SPIP-based websites should treat this as an emergency update. Upgrade to SPIP 4.4.20 or later immediately and review systems for signs of compromise. Refer to the vendor advisory at blog.spip.net for full details. ...
62 vulnerabilities across 15 products scored HIGH or above on August 19, 2026. 🟠 HIGH: 62 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. 🟠 [HIGH] ibm/aix 21 CVEs | CVSS 3.1: 9.9 | AAS 11.9 cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:* (>= 7.2.5, <= 7.2.5.212) cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:* (>= 7.3.2, <= 7.3.2.5) cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:* (>= 7.3.3, <= 7.3.3.2) cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:* (>= 7.3.4, <= 7.3.4.1) cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:* (>= 4.1.0, < 4.1.0.50) IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, are affected by 21 vulnerabilities, including multiple critical issues with CVSS scores up to 9.9. The most severe flaw allows remote attackers to execute arbitrary code through improper validation of network-supplied pointers, and exploitation is considered feasible. Administrators running AIX or PowerVM VIOS in their environments should prioritize patching immediately by reviewing the vendor advisory at https://www.ibm.com/support/pages/node/7283858 and applying all available fixes. ...
31 vulnerabilities across 15 products scored HIGH or above on August 18, 2026. 🔴 CRITICAL: 7 🟠 HIGH: 24 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. 🔴 [CRITICAL] oracle_corporation/oracle_weblogic_server 7 CVEs | CVSS 3.1: 9.9 | AAS 12.9 cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 12.2.1.4.0) cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 14.1.1.0.0) cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 14.1.2.0.0) cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 15.1.1.0.0) cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 12.2.1.4.0, < 12.2.1.4.0) Oracle WebLogic Server is affected by seven vulnerabilities disclosed in the August 2026 Critical Patch Update, including multiple critical-severity flaws. The most severe, carrying a CVSS score of 9.8, allows an unauthenticated attacker with network access via IIOP to fully compromise WebLogic Server without any user interaction. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Organizations running Oracle WebLogic Server in any capacity should prioritize applying the patches from Oracle’s August 2026 security advisory immediately, and as an interim measure consider restricting network access to IIOP endpoints. ...
19 vulnerabilities across 15 products scored HIGH or above on August 17, 2026. 🔴 CRITICAL: 2 🟠 HIGH: 17 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. 🔴 [CRITICAL] patriksimek/vm2 2 CVEs | CVSS 3.1: 9.9 | AAS 12.8 ...
13 vulnerabilities across 6 products scored HIGH or above on August 16, 2026. 🟠 HIGH: 13 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. 🟠 [HIGH] prosolution/prosolution_wp_client 2 CVEs | CVSS 3.1: 9.8 | AAS 10.9 ...
5 vulnerabilities across 5 products scored HIGH or above on August 15, 2026. 🟠 HIGH: 5 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. 🟠 [HIGH] sixstorage/6storage_rentals 1 CVE | CVSS 3.1: 9.8 | AAS 10.9 ...