Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
12 vulnerabilities across 7 products scored HIGH or above on August 14, 2026. 🟠 HIGH: 12 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-71558 (apache/fory) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-62873 (microsoft/microsoft_365_admin_center) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-08-07 bulletin. 🟠 [HIGH] laravel/socialite 1 CVE | CVSS 4.0: 9.2 | AAS 10.6 ...
38 vulnerabilities across 15 products scored HIGH or above on August 13, 2026. 🔴 CRITICAL: 18 🟠 HIGH: 20 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-71558 (apache/fory) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-62873 (microsoft/microsoft_365_admin_center) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-65507 (flavor/aiwu) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-5430 (wso2/api_control_plane) — F1: theoretical → poc, AAS: 10.7 → 13.2 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-34191 (apache/apr-util) — F1: exploitable → functional, AAS: 10.5 → 13.7 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-28139 (ajax_search_lite/ajax_search_lite) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2025-15039 (wso2/api_control_plane) — F1: theoretical → itw, AAS: 9.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-65583 (apache/cxf) — F1: exploitable → functional, AAS: 9.9 → 11.9 (HIGH → HIGH). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-68079 (apache/cxf) — F1: theoretical → poc, AAS: 9.6 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. 🔴 [CRITICAL] miniorange/miniorange_otp_verification 1 CVE | CVSS 3.1: 9.8 | AAS 12.9 ...
30 vulnerabilities across 15 products scored HIGH or above on August 12, 2026. 🔴 CRITICAL: 11 🟠 HIGH: 19 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-71558 (apache/fory) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-62873 (microsoft/microsoft_365_admin_center) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-65507 (flavor/aiwu) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-5430 (wso2/api_control_plane) — F1: theoretical → poc, AAS: 10.7 → 13.2 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-34191 (apache/apr-util) — F1: exploitable → functional, AAS: 10.5 → 13.7 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-28139 (ajax_search_lite/ajax_search_lite) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2025-15039 (wso2/api_control_plane) — F1: theoretical → itw, AAS: 9.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-65583 (apache/cxf) — F1: exploitable → functional, AAS: 9.9 → 11.9 (HIGH → HIGH). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-68079 (apache/cxf) — F1: theoretical → poc, AAS: 9.6 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-48168 (mervinpraison/praisonai) — F1: exploitable → functional, AAS: 10.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-08-05 bulletin. 🔴 [CRITICAL] fortinet/fortiweb 1 CVE | CVSS 3.1: 9.8 | AAS 14.9 ...
113 vulnerabilities across 15 products scored HIGH or above on August 11, 2026. 🟣 EMERGENCY: 1 🔴 CRITICAL: 47 🟠 HIGH: 65 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-71558 (apache/fory) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-62873 (microsoft/microsoft_365_admin_center) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-65507 (flavor/aiwu) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-5430 (wso2/api_control_plane) — F1: theoretical → poc, AAS: 10.7 → 13.2 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-34191 (apache/apr-util) — F1: exploitable → functional, AAS: 10.5 → 13.7 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-28139 (ajax_search_lite/ajax_search_lite) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2025-15039 (wso2/api_control_plane) — F1: theoretical → itw, AAS: 9.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-65583 (apache/cxf) — F1: exploitable → functional, AAS: 9.9 → 11.9 (HIGH → HIGH). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-68079 (apache/cxf) — F1: theoretical → poc, AAS: 9.6 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-48168 (mervinpraison/praisonai) — F1: exploitable → functional, AAS: 10.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-08-05 bulletin. [UPGRADED] CVE-2026-70478 (flowiseai/flowise) — F1: theoretical → poc, AAS: 9.9 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-04 bulletin. 🟣 [EMERGENCY] adobe/coldfusion_2025 5 CVEs | CVSS 3.1: 10.0 | AAS 16.8 ...
40 vulnerabilities across 15 products scored HIGH or above on August 10, 2026. 🔴 CRITICAL: 9 🟠 HIGH: 31 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-71558 (apache/fory) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-62873 (microsoft/microsoft_365_admin_center) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-65507 (sergey/aiwu) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-5430 (wso2/api_control_plane) — F1: theoretical → poc, AAS: 10.7 → 13.2 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-34191 (apache/apr-util) — F1: exploitable → functional, AAS: 10.5 → 13.7 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-28139 (wpdreams/ajax_search_lite) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2025-15039 (wso2/wso2_identity_server) — F1: theoretical → itw, AAS: 9.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-65583 (apache/cxf) — F1: exploitable → functional, AAS: 9.9 → 11.9 (HIGH → HIGH). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-68079 (apache/cxf) — F1: theoretical → poc, AAS: 9.6 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-48168 (mervinpraison/praisonai) — F1: exploitable → functional, AAS: 10.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-08-05 bulletin. [UPGRADED] CVE-2026-70478 (flowiseai/flowise) — F1: theoretical → poc, AAS: 9.9 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-04 bulletin. [UPGRADED] CVE-2026-39931 (openemr/openemr) — F1: exploitable → functional, AAS: 9.1 → 11.1 (HIGH → HIGH). Originally in 2026-08-03 bulletin. [UPGRADED] CVE-2026-38447 (osticket/osticket) — F1: theoretical → poc, AAS: 9.6 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-03 bulletin. [UPGRADED] CVE-2026-46713 (misskey-dev/misskey) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-08-03 bulletin. 🔴 [CRITICAL] metabase/metabase 2 CVEs | CVSS 4.0: 10.0 | AAS 12.9 ...
7 vulnerabilities across 1 product scored HIGH or above on August 09, 2026. 🟠 HIGH: 7 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65507 (sergey/aiwu) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-5430 (wso2/wso2_universal_gateway) — F1: theoretical → poc, AAS: 10.7 → 13.2 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-34191 (apache/apr-util) — F1: exploitable → functional, AAS: 10.5 → 13.7 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-28139 (wpdreams/ajax_search_lite) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2025-15039 (wso2/wso2_identity_server) — F1: theoretical → itw, AAS: 9.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-68079 (apache/cxf) — F1: theoretical → poc, AAS: 9.6 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-70478 (flowiseai/flowise) — F1: theoretical → poc, AAS: 9.9 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-04 bulletin. [UPGRADED] CVE-2026-39931 (openemr/openemr) — F1: exploitable → functional, AAS: 9.1 → 11.1 (HIGH → HIGH). Originally in 2026-08-03 bulletin. [UPGRADED] CVE-2026-38447 (osticket/osticket) — F1: theoretical → poc, AAS: 9.6 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-03 bulletin. [UPGRADED] CVE-2026-46713 (misskey-dev/misskey) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-08-03 bulletin. 🟠 [HIGH] msi/radix_axe6600 7 CVEs | CVSS 4.0: 9.3 | AAS 9.2 ...
10 vulnerabilities across 9 products scored HIGH or above on August 07, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 9 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-67305 (freerdp/freerdp) — F1: exploitable → functional, AAS: 10.0 → 12.0 (HIGH → CRITICAL). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-15988 (suspended_starter/ai_engine) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-67320 (axios/axios) — F1: theoretical → poc, AAS: 9.4 → 11.9 (HIGH → HIGH). Originally in 2026-08-01 bulletin. 🔴 [CRITICAL] wordpress/wordpress 1 CVE | CVSS 4.0: 8.9 | AAS 13.6 ...
29 vulnerabilities across 15 products scored HIGH or above on August 06, 2026. 🟠 HIGH: 29 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-67305 (freerdp/freerdp) — F1: exploitable → functional, AAS: 10.0 → 12.0 (HIGH → CRITICAL). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-15988 (suspended_starter/ai_engine) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-67320 (axios/axios) — F1: theoretical → poc, AAS: 9.4 → 11.9 (HIGH → HIGH). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-48449 (adobe/campaign) — F1: exploitable → functional, AAS: 10.2 → 12.6 (HIGH → CRITICAL). Originally in 2026-07-30 bulletin. 🟠 [HIGH] wso2/wso2_api_manager 2 CVEs | CVSS 3.1: 9.8 | AAS 11.4 ...
19 vulnerabilities across 15 products scored HIGH or above on August 05, 2026. 🟠 HIGH: 19 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-15988 (suspended_starter/ai_engine) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-67320 (axios/axios) — F1: theoretical → poc, AAS: 9.4 → 11.9 (HIGH → HIGH). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-48449 (adobe/campaign) — F1: exploitable → functional, AAS: 10.2 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-30 bulletin. 🟠 [HIGH] mervinpraison/praisonai 1 CVE | CVSS 3.1: 10.0 | AAS 10.8 ...
38 vulnerabilities across 14 products scored HIGH or above on August 04, 2026. 🟠 HIGH: 38 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-67305 (freerdp/freerdp) — F1: exploitable → functional, AAS: 10.0 → 12.0 (HIGH → CRITICAL). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-15988 (suspended_starter/ai_engine) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-67320 (axios/axios) — F1: theoretical → poc, AAS: 9.4 → 11.9 (HIGH → HIGH). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-48449 (adobe/campaign_classic) — F1: exploitable → functional, AAS: 10.2 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-30 bulletin. 🟠 [HIGH] cinnamon/kotaemon 1 CVE | CVSS 4.0: 9.3 | AAS 11.6 ...