Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
26 vulnerabilities across 13 products scored HIGH or above on August 03, 2026. 🔴 CRITICAL: 2 🟠 HIGH: 24 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-67305 (freerdp/freerdp) — F1: exploitable → functional, AAS: 10.0 → 12.0 (HIGH → CRITICAL). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-15988 (suspended_starter/ai_engine) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-67320 (axios/axios) — F1: theoretical → poc, AAS: 9.4 → 11.9 (HIGH → HIGH). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-65921 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-66014 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-65617 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. 🔴 [CRITICAL] openemr/openemr 4 CVEs | CVSS 4.0: 9.4 | AAS 12.2 ...
2 vulnerabilities across 2 products scored HIGH or above on August 02, 2026. 🟠 HIGH: 2 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-67305 (freerdp/freerdp) — F1: exploitable → functional, AAS: 10.0 → 12.0 (HIGH → CRITICAL). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-15988 (suspended_starter/ai_engine) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-67320 (axios/axios) — F1: theoretical → poc, AAS: 9.4 → 11.9 (HIGH → HIGH). Originally in 2026-08-01 bulletin. [UPGRADED] CVE-2026-65921 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-66014 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-65617 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. 🟠 [HIGH] go-vikunja/vikunja 1 CVE | CVSS 4.0: 9.3 | AAS 9.7 ...
10 vulnerabilities across 4 products scored HIGH or above on August 01, 2026. 🟠 HIGH: 10 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65921 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-66014 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-65617 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. 🟠 [HIGH] freerdp/freerdp 6 CVEs | CVSS 4.0: 9.4 | AAS 10.0 ...
13 vulnerabilities across 7 products scored HIGH or above on July 31, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 12 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65921 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-66014 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-65617 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. 🔴 [CRITICAL] codeigniter4/codeigniter4 2 CVEs | CVSS 3.1: 9.8 | AAS 12.3 ...
25 vulnerabilities across 15 products scored HIGH or above on July 30, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 24 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65921 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-66014 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-65617 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. 🔴 [CRITICAL] somta/juggle 1 CVE | CVSS 4.0: 9.3 | AAS 12.0 ...
20 vulnerabilities across 10 products scored HIGH or above on July 29, 2026. 🔴 CRITICAL: 4 🟠 HIGH: 16 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-51235 (programmervuln/cveadvisory-) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-65921 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-66014 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. [UPGRADED] CVE-2026-65617 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin. 🔴 [CRITICAL] ibm/websphere_application_server 1 CVE | CVSS 3.1: 9.4 | AAS 13.1 ...
14 vulnerabilities across 7 products scored HIGH or above on July 28, 2026. 🔴 CRITICAL: 3 🟠 HIGH: 11 🔴 [CRITICAL] ibm/websphere_application_server 6 CVEs | CVSS 3.1: 9.8 | AAS 13.9 cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* (>= 8.5.0) cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* (>= 9.0.0) cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* (>= 8.5) cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* (>= 9.0) cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* (>= 17.0.0.3, < 26.0.0.8) IBM WebSphere Application Server versions 8.5 and 9.0 (traditional) are affected by six vulnerabilities, including multiple critical issues. The most severe, rated CVSS 9.8, involves a pre-authentication unsafe deserialization flaw that could allow a remote attacker to bypass authentication or execute arbitrary code without any prior access. Active exploitation is considered feasible, making this an urgent priority. ...
33 vulnerabilities across 13 products scored HIGH or above on July 27, 2026. 🔴 CRITICAL: 3 🟠 HIGH: 30 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-63770 (glanceapp/glance) — F1: theoretical → poc, AAS: 9.0 → 11.5 (HIGH → HIGH). Originally in 2026-07-20 bulletin. 🔴 [CRITICAL] arista/velocloud_orchestrator 1 CVE | CVSS 4.0: 10.0 | AAS 14.3 cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* (>= 5.2.0, < 5.2.3.14) cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* (>= 6.1.0, < 6.1.3.4) cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* (>= 6.4.0, < 6.4.2.4) Arista VeloCloud Orchestrator (VCO) on-premises deployments are affected by a critical vulnerability (CVE-2026-16812, CVSS 10.0) that exposes privileged internal functionality to remote attackers. Successful exploitation can fully compromise the confidentiality, integrity, and availability of the orchestrator and all data it manages. This vulnerability is being exploited in the wild. ...
1 vulnerability across 1 product scored HIGH or above on July 25, 2026. 🟠 HIGH: 1 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-63770 (glanceapp/glance) — F1: theoretical → poc, AAS: 9.0 → 11.5 (HIGH → HIGH). Originally in 2026-07-20 bulletin. 🟠 [HIGH] openremote/openremote 1 CVE | CVSS 4.0: 9.3 | AAS 9.7 cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:* OpenRemote — Authentication Bypass in Console Registration API ...
12 vulnerabilities across 8 products scored HIGH or above on July 24, 2026. 🟠 HIGH: 12 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-63770 (glanceapp/glance) — F1: theoretical → poc, AAS: 9.0 → 11.5 (HIGH → HIGH). Originally in 2026-07-20 bulletin. 🟠 [HIGH] microsoft/microsoft_account 1 CVE | CVSS 3.1: 9.8 | AAS 10.6 cpe:2.3:a:microsoft:microsoft_account:*:*:*:*:*:*:*:* Microsoft Account is affected by a critical remote code execution vulnerability (CVE-2026-56165, CVSS 9.8) caused by a heap-based buffer overflow that allows an unauthorized attacker to execute arbitrary code over the network. This vulnerability is considered exploitable, making it an urgent priority for any organization relying on Microsoft Account services. Security teams should review the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56165 and apply available patches or mitigations immediately. ...