Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
No EMERGENCY vulnerabilities this month.
14 vulnerabilities across 11 products scored HIGH or above on June 18, 2026. 🟠 HIGH: 14 🟠 [HIGH] getkirby/cms 3 CVEs | CVSS 3.1: 9.5 | AAS 11.8 cpe:2.3:a:getkirby:cms:*:*:*:*:*:*:*:* Kirby CMS by getkirby is affected by three vulnerabilities, including at least one rated HIGH severity with a CVSS score of 9.5. The most critical issue allows remote attackers to complete the Panel installation process and create an admin account on sites that have no configured users and sit behind a reverse proxy setting certain forwarded-for headers. Security teams managing Kirby CMS deployments, particularly those exposed to the internet behind reverse proxies, should review the vendor advisory at the linked GitHub Security Advisory and apply available patches immediately. ...
32 vulnerabilities across 15 products scored HIGH or above on June 17, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 31 🔴 [CRITICAL] pip/langflow 1 CVE | CVSS 3.1: 9.3 | AAS 12.4 cpe:2.3:a:pip:langflow:*:*:*:*:*:*:*:* Langflow, the open-source AI application builder distributed via pip, is affected by a critical unauthenticated file upload vulnerability (CVE-2026-55450, CVSS 9.3 CRITICAL). The flaw allows remote attackers with nothing more than network access to upload unlimited data to the server without authentication, leading to disk space exhaustion and denial of service. The server response also leaks the absolute file path of uploaded files, which could aid in chaining additional attacks. ...
40 vulnerabilities across 15 products scored HIGH or above on June 16, 2026. CRITICAL: 17 HIGH: 23 [CRITICAL] pip/langflow 3 CVEs | CVSS 3.1: 9.6 | AAS 13.4 cpe:2.3:a:pip:langflow:*:*:*:*:*:*:*:* Langflow contains three critical vulnerabilities affecting its Shareable Playground feature, with CVE-2026-48519 rated CVSS 9.6, enabling remote code execution when workflows are shared via public links. Organizations using Langflow should immediately apply patches or disable public flow sharing functionality, as exploits are publicly available. Consult the vendor advisory at https://github.com/advisories/GHSA-v5ff-9q35-q26f for guidance on affected versions and remediation steps. ...
17 vulnerabilities across 15 products scored HIGH or above on June 15, 2026. HIGH: 17 [HIGH] spring/spring_cloud_gateway 1 CVE | CVSS 3.1: 8.6 | AAS 11.4 cpe:2.3:a:spring:spring_cloud_gateway:*:*:*:*:*:*:*:* (>= 3.1.0, < 3.1.13) cpe:2.3:a:spring:spring_cloud_gateway:*:*:*:*:*:*:*:* (>= 4.1.0, < 4.1.13) cpe:2.3:a:spring:spring_cloud_gateway:*:*:*:*:*:*:*:* (>= 4.2.0, < 4.2.9) cpe:2.3:a:spring:spring_cloud_gateway:*:*:*:*:*:*:*:* (>= 4.3.0, < 4.3.5) cpe:2.3:a:spring:spring_cloud_gateway:*:*:*:*:*:*:*:* (>= 5.0.0, < 5.0.2) Spring Cloud Gateway versions 3.1.x through 5.0.x are vulnerable to header spoofing attacks (CVE-2026-47825, CVSS 8.6) in both WebMVC and WebFlux implementations when certain proxy configurations forward untrusted headers. Attackers can manipulate X-Forwarded-For and Forwarded headers to bypass authentication or redirect traffic in affected deployments. Organizations should upgrade to patched versions 3.1.13, 4.1.13, 4.2.9, 4.3.5, or 5.0.2 immediately, or disable untrusted proxy header forwarding in their configuration. ...
2 vulnerabilities across 2 products scored HIGH or above on June 14, 2026. HIGH: 2 [HIGH] litespeed_technologies/cpanel_plugin 1 CVE | CVSS 3.1: 8.5 | AAS 11.0 cpe:2.3:a:litespeed_technologies:cpanel_plugin:*:*:*:*:*:*:*:* (< 2.4.8) LiteSpeed cPanel plugin versions before 2.4.8 (as distributed in LiteSpeed WHM Plugin before 5.3.2.0) mishandle symlinks on shared hosting servers running CloudLinux/CageFS, allowing attackers with FTP or web shell access to bypass security controls (CVE-2026-54420, CVSS 8.5). This vulnerability has been actively exploited since May 2026. Hosting providers and system administrators managing shared hosting environments should immediately update to patched versions via https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/. ...
2 vulnerabilities across 2 products scored HIGH or above on June 13, 2026. HIGH: 2 [HIGH] google/mcp_toolbox_for_databases 1 CVE | CVSS 4.0: 9.4 | AAS 9.5 cpe:2.3:a:google:mcp_toolbox_for_databases:*:*:*:*:*:*:*:* (< 0.25.0) Google’s MCP Toolbox for Databases versions before v0.25.0 are vulnerable to DNS rebinding attacks due to missing validation of the Origin header’s host portion (CVE-2026-11624, CVSS 9.4). Teams operating MCP server instances must upgrade to v0.25.0 and configure the new –allowed-hosts flag to enforce strict access controls. While exploitation remains theoretical, this vulnerability could allow attackers to bypass network boundaries and execute commands against vulnerable servers. ...
31 vulnerabilities across 15 products scored HIGH or above on June 12, 2026. CRITICAL: 14 HIGH: 17 [CRITICAL] nezhahq/nezha 2 CVEs | CVSS 3.1: 9.9 | AAS 14.7 cpe:2.3:a:nezhahq:nezha:*:*:*:*:*:*:*:* (>= 1.4.0, < 2.0.8) cpe:2.3:a:nezhahq:nezha:*:*:*:*:*:*:*:* (< 2.0.13) Nezha monitoring software versions 1.4.0 through 2.0.7 contain two critical vulnerabilities (CVSS 9.9) allowing restricted users to execute arbitrary commands on all servers in the deployment, including systems they should not access. Exploit code is available. Organizations running Nezha should upgrade immediately to version 2.0.8 or later and review access controls for user roles. ...
22 vulnerabilities across 15 products scored HIGH or above on June 11, 2026. EMERGENCY: 1 CRITICAL: 2 HIGH: 19 [EMERGENCY] oracle/peoplesoft_enterprise_peopletools 1 CVE | CVSS 3.1: 9.8 | AAS 17.1 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:* Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 are affected by CVE-2026-35273, a critical unauthenticated remote code execution vulnerability in the Updates Environment Management component that allows attackers to fully compromise affected systems via HTTP. With a CVSS score of 9.8 and active exploitation occurring in the wild, organizations running these versions should immediately apply patches from Oracle’s security advisory. This vulnerability poses an emergency-level risk to any organization using the affected PeopleSoft versions and should be prioritized for immediate remediation. ...
28 vulnerabilities across 15 products scored HIGH or above on June 10, 2026. CRITICAL: 2 HIGH: 26 [CRITICAL] splunk/splunk_enterprise 1 CVE | CVSS 3.1: 9.8 | AAS 12.6 cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* (< 10.0.7) cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* (< 10.2.4) cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* (< 10.2.2510.14) cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* (< 10.4.2604.3) Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14 are vulnerable to unauthenticated arbitrary file creation and truncation (CVE-2026-20253, CVSS 9.8 CRITICAL) through an unprotected PostgreSQL sidecar endpoint. Proof-of-concept code is publicly available, allowing any network-reachable user to perform file operations without authentication credentials. Organizations operating affected Splunk deployments should immediately apply vendor patches or restrict network access to the sidecar service endpoint as a temporary mitigation until updates are deployed. ...
31 vulnerabilities across 15 products scored HIGH or above on June 09, 2026. CRITICAL: 25 HIGH: 6 [CRITICAL] ivanti/sentry 1 CVE | CVSS 3.1: 9.9 | AAS 14.2 cpe:2.3:a:ivanti:sentry:*:*:*:*:*:*:*:* (< R10.5.2) cpe:2.3:a:ivanti:sentry:*:*:*:*:*:*:*:* (< R10.6.2) cpe:2.3:a:ivanti:sentry:*:*:*:*:*:*:*:* (< R10.7.1) Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 is vulnerable to a critical authentication bypass (CVE-2026-10523, CVSS 9.9) that allows unauthenticated attackers to create arbitrary administrative accounts and assume full administrative control. Organizations operating affected Sentry instances must apply vendor patches immediately or restrict Sentry network access to trusted networks only. Functional exploits are publicly available. ...