Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
No EMERGENCY vulnerabilities this month.
18 vulnerabilities across 9 products scored HIGH or above on September 28, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 17 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-82901 (themefic/ultra_addons_for_contact_form_7) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-26 bulletin. [UPGRADED] CVE-2026-93577 (gitlab/gitlab) — F1: exploitable → functional, AAS: 11.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin. [UPGRADED] CVE-2026-12227 (visualcomposer/visual_composer_website_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin. [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin. [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin. 🔴 [CRITICAL] apache_software_foundation/apache_roller 5 CVEs | CVSS 3.1: 9.9 | AAS 13.4 ...
8 vulnerabilities across 6 products scored HIGH or above on September 27, 2026. 🟠 HIGH: 8 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-93577 (gitlab/gitlab) — F1: exploitable → functional, AAS: 11.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin. [UPGRADED] CVE-2026-12227 (visualcomposer/visual_composer_website_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin. [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin. [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin. 🟠 [HIGH] progressive_robot_ltd/hmailserver 1 CVE | CVSS 3.1: 9.8 | AAS 11.9 ...
27 vulnerabilities across 10 products scored HIGH or above on September 26, 2026. 🟠 HIGH: 27 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-93577 (gitlab/gitlab) — F1: exploitable → functional, AAS: 11.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin. [UPGRADED] CVE-2026-12227 (visualcomposer/visual_composer_website_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin. [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin. [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin. [UPGRADED] CVE-2026-92229 (wpmudev/forminator) — F1: exploitable → functional, AAS: 9.9 → 11.9 (HIGH → HIGH). Originally in 2026-09-19 bulletin. [UPGRADED] CVE-2026-89274 (bootstrapped_ventures/wp_recipe_maker) — F1: exploitable → functional, AAS: 9.4 → 11.4 (HIGH → HIGH). Originally in 2026-09-19 bulletin. 🟠 [HIGH] flowiseai/flowise 3 CVEs | CVSS 4.0: 9.2 | AAS 11.3 ...
8 vulnerabilities across 6 products scored HIGH or above on September 25, 2026. 🟠 HIGH: 8 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-12227 (visualcomposer/visual_composer_website_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin. [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin. [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin. [UPGRADED] CVE-2026-92229 (wpmudev/forminator) — F1: exploitable → functional, AAS: 9.9 → 11.9 (HIGH → HIGH). Originally in 2026-09-19 bulletin. [UPGRADED] CVE-2026-89274 (bootstrapped_ventures/wp_recipe_maker) — F1: exploitable → functional, AAS: 9.4 → 11.4 (HIGH → HIGH). Originally in 2026-09-19 bulletin. [UPGRADED] CVE-2026-93603 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-93605 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-93606 (patriksimek/vm2) — F1: theoretical → functional, AAS: 11.7 → 14.7 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-82340 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-81657 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. 🟠 [HIGH] gestsup/gestsup 1 CVE | CVSS 4.0: 9.2 | AAS 10.2 ...
7 vulnerabilities across 6 products scored HIGH or above on September 24, 2026. 🟠 HIGH: 7 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin. [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin. [UPGRADED] CVE-2026-93603 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-93605 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-93606 (patriksimek/vm2) — F1: theoretical → functional, AAS: 11.7 → 14.7 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-82340 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-81657 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-28326 (solarwinds/access_rights_manager) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-17 bulletin. 🟠 [HIGH] gitlab/gitlab 2 CVEs | CVSS 3.1: 9.9 | AAS 11.9 ...
13 vulnerabilities across 10 products scored HIGH or above on September 23, 2026. 🟠 HIGH: 13 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin. [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin. [UPGRADED] CVE-2026-93603 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-93605 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-93606 (patriksimek/vm2) — F1: theoretical → functional, AAS: 11.7 → 14.7 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-81657 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-12793 (jetmonsters/jetformbuilder_—_dynamic_blocks_form_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-16 bulletin. 🟠 [HIGH] rabbitmq/rabbitmq-server 2 CVEs | CVSS 4.0: 9.2 | AAS 11.2 ...
32 vulnerabilities across 15 products scored HIGH or above on September 22, 2026. 🔴 CRITICAL: 2 🟠 HIGH: 30 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin. [UPGRADED] CVE-2026-93603 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-93605 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-93606 (patriksimek/vm2) — F1: theoretical → functional, AAS: 11.7 → 14.7 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-81657 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-12793 (jetmonsters/jetformbuilder_—_dynamic_blocks_form_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-16 bulletin. 🔴 [CRITICAL] adobe/aem_6.5_forms_jee 1 CVE | CVSS 3.1: 10.0 | AAS 13.8 ...
8 vulnerabilities across 6 products scored HIGH or above on September 21, 2026. 🟠 HIGH: 8 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-93603 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-93605 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-12793 (jetmonsters/jetformbuilder_—_dynamic_blocks_form_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-16 bulletin. 🟠 [HIGH] 1panel-dev/maxkb 2 CVEs | CVSS 3.1: 10.0 | AAS 11.2 ...
3 vulnerabilities across 2 products scored HIGH or above on September 20, 2026. 🟠 HIGH: 3 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-12793 (jetmonsters/jetformbuilder_—_dynamic_blocks_form_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-16 bulletin. 🟠 [HIGH] oisf/suricata 2 CVEs | CVSS 3.1: 9.4 | AAS 10.9 ...
4 vulnerabilities across 4 products scored HIGH or above on September 19, 2026. 🟠 HIGH: 4 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin. [UPGRADED] CVE-2026-12793 (jetmonsters/jetformbuilder_—_dynamic_blocks_form_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-16 bulletin. 🟠 [HIGH] gravity_forms/gravity_forms 1 CVE | CVSS 3.1: 9.8 | AAS 10.6 ...