Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
No EMERGENCY vulnerabilities this month.
8 vulnerabilities across 6 products scored HIGH or above on June 29, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 7 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-52785 (opf/openproject) — F1: exploitable → functional, AAS: 11.1 → 13.1 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-45405 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 12.8 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-54636 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 13.9 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-52884 (notepad-plus-plus/notepad) — F1: exploitable → functional, AAS: 9.1 → 11.1 (HIGH → HIGH). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-54825 (wpdatatables/wpdatatables) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-50189 (appsmith/appsmith) — F1: exploitable → functional, AAS: 9.7 → 10.8 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-54067 (siyuan-note/siyuan) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-52794 (sentry/sentry) — F1: exploitable → itw, AAS: 9.3 → 10.9 (HIGH → HIGH). Originally in 2026-06-24 bulletin. 🔴 [CRITICAL] coollabsio/coolify 3 CVEs | CVSS 3.1: 9.6 | AAS 12.7 ...
2 vulnerabilities across 2 products scored HIGH or above on June 28, 2026. 🟠 HIGH: 2 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-50189 (appsmith/appsmith) — F1: exploitable → functional, AAS: 9.7 → 10.8 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-54067 (siyuan-note/siyuan) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-06-24 bulletin. 🟠 [HIGH] ffmpeg/ffmpeg 1 CVE | CVSS 4.0: 8.8 | AAS 10.2 ...
29 vulnerabilities across 15 products scored HIGH or above on June 26, 2026. 🔴 CRITICAL: 6 🟠 HIGH: 23 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-50189 (appsmith/appsmith) — F1: exploitable → functional, AAS: 9.7 → 10.8 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-54067 (siyuan-note/siyuan) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-06-24 bulletin. 🔴 [CRITICAL] jdx/mise 2 CVEs | CVSS 3.1: 9.6 | AAS 14.5 ...
29 vulnerabilities across 15 products scored HIGH or above on June 25, 2026. 🟣 EMERGENCY: 4 🔴 CRITICAL: 6 🟠 HIGH: 19 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-50189 (appsmithorg/appsmith) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-54067 (siyuan-note/siyuan) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-06-24 bulletin. 🟣 [EMERGENCY] flowise/flowise 6 CVEs | CVSS 4.0: 10.0 | AAS 16.0 ...
48 vulnerabilities across 15 products scored HIGH or above on June 24, 2026. 🔴 CRITICAL: 20 🟠 HIGH: 28 🔴 [CRITICAL] tryghost/ghost 1 CVE | CVSS 3.1: 9.6 | AAS 15.5 cpe:2.3:a:tryghost:ghost:*:*:*:*:*:*:*:* Ghost CMS by TryGhost is affected by a critical cache poisoning vulnerability (CVE-2026-53943, CVSS 9.6) in versions prior to 6.37.0. An unauthenticated attacker can manipulate the x-ghost-preview header to inject altered content into shared caching layers, causing poisoned responses to be served to all subsequent visitors of the same page. A proof-of-concept exploit is publicly available. ...
9 vulnerabilities across 3 products scored HIGH or above on June 23, 2026. 🟠 HIGH: 9 🟠 [HIGH] gogs.io/gogs 6 CVEs | CVSS 3.1: 10.0 | AAS 11.8 cpe:2.3:a:gogs.io:gogs:*:*:*:*:*:*:*:* Gogs, the self-hosted Git service from gogs.io, is affected by six vulnerabilities, including at least one critical-severity issue carrying a CVSS score of 10.0. The most severe flaw allows an attacker to exploit path traversal in organization names to write repositories to arbitrary filesystem locations, ultimately achieving remote code execution by overwriting Git hook configurations. Security teams running self-hosted Gogs instances should treat this as an urgent priority, review the vendor advisory at the linked GitHub Security Advisory page, and apply patches or mitigations as soon as they become available. ...
23 vulnerabilities across 14 products scored HIGH or above on June 22, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 22 🔴 [CRITICAL] phpoffice/phpspreadsheet 1 CVE | CVSS 4.0: 9.2 | AAS 12.5 cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* PHPOffice PhpSpreadsheet, a widely used PHP library for reading and writing spreadsheet files, is affected by a critical severity vulnerability (CVE-2026-45034, CVSS 9.2) that bypasses a prior security fix for stream wrapper restrictions. An attacker can craft malicious file paths with additional slashes to evade the wrapper prohibition check, potentially enabling exploitation through dangerous PHP stream wrappers such as phar://, php://, or expect://. A functional exploit is available, making this an urgent priority for any team running applications that use PhpSpreadsheet to process user-supplied files. ...
2 vulnerabilities across 1 product scored HIGH or above on June 21, 2026. 🟠 HIGH: 2 🟠 [HIGH] siyuan/siyuan 2 CVEs | CVSS 4.0: 9.4 | AAS 10.2 cpe:2.3:a:siyuan:siyuan:*:*:*:*:*:*:*:* (< 3.6.1) SiYuan note-taking application versions prior to 3.6.1 are affected by 2 vulnerabilities, including multiple issues related to insufficient sanitization of package metadata and README content in the Bazaar marketplace. The most severe, rated CVSS 9.4 HIGH, allows malicious package authors to inject arbitrary HTML and JavaScript through crafted package fields such as displayName, description, or README content. Because SiYuan runs on Electron with nodeIntegration enabled, successful exploitation escalates from cross-site scripting to full remote code execution, enabling attackers to run arbitrary OS commands on any user who simply browses the marketplace. Organizations and individuals using SiYuan should upgrade to version 3.6.1 or later immediately and review the vendor advisory at the linked GitHub security page for additional details. ...
2 vulnerabilities across 2 products scored HIGH or above on June 20, 2026. 🟠 HIGH: 2 🟠 [HIGH] wpmudev/branda_–white_label&_branding,_free_login_page_customizer 1 CVE | CVSS 3.1: 9.8 | AAS 11.6 cpe:2.3:a:wpmudev:branda_white_label_branding_free_login_page_customizer:*:*:*:*:*:*:*:* (< 3.4.30) WPMU DEV Branda – White Label & Branding plugin for WordPress versions up to and including 3.4.29 contains a critical privilege escalation vulnerability (CVE-2026-11551, CVSS 9.8) that allows unauthenticated attackers to reset any user’s password, including administrator accounts, due to improper identity validation during password changes. A proof-of-concept exploit is publicly available, making active exploitation highly likely. WordPress administrators running Branda should update immediately to a patched version or disable the plugin until a fix is applied, and audit admin accounts for signs of unauthorized password changes or suspicious logins. ...
15 vulnerabilities across 12 products scored HIGH or above on June 19, 2026. 🔴 CRITICAL: 3 🟠 HIGH: 12 🔴 [CRITICAL] langflow-ai/langflow 2 CVEs | CVSS 3.1: 9.9 | AAS 13.1 cpe:2.3:a:langflow-ai:langflow:*:*:*:*:*:*:*:* Langflow by langflow-ai is affected by 2 vulnerabilities, including at least one rated CRITICAL with a CVSS score of 9.9. The most severe issue is an Insecure Direct Object Reference flaw in the responses API endpoint that allows any authenticated user to execute flows belonging to other users by simply specifying a victim’s flow ID, effectively bypassing all access controls between tenants. ...