Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
26 vulnerabilities across 15 products scored HIGH or above on July 23, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 25 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-63770 (glanceapp/glance) — F1: theoretical → poc, AAS: 9.0 → 11.5 (HIGH → HIGH). Originally in 2026-07-20 bulletin. [UPGRADED] CVE-2026-45695 (kopia/kopia) — F1: exploitable → functional, AAS: 11.1 → 13.1 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-55579 (pheditor/pheditor) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-54526 (argoproj/argo-workflows) — F1: exploitable → itw, AAS: 9.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. 🔴 [CRITICAL] jetbrains/intellij_idea 3 CVEs | CVSS 3.1: 10.0 | AAS 12.1 ...
4 vulnerabilities across 3 products scored HIGH or above on July 22, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 3 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-63770 (glanceapp/glance) — F1: theoretical → poc, AAS: 9.0 → 11.5 (HIGH → HIGH). Originally in 2026-07-20 bulletin. [UPGRADED] CVE-2026-45695 (kopia/kopia) — F1: exploitable → functional, AAS: 11.1 → 13.1 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-55579 (pheditor/pheditor) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-54526 (argoproj/argo-workflows) — F1: exploitable → itw, AAS: 9.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. 🔴 [CRITICAL] check_point/security_management 1 CVE | CVSS 3.1: 9.1 | AAS 12.0 ...
130 vulnerabilities across 9 products scored HIGH or above on July 21, 2026. 🔴 CRITICAL: 5 🟠 HIGH: 125 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-63770 (glanceapp/glance) — F1: theoretical → poc, AAS: 9.0 → 11.5 (HIGH → HIGH). Originally in 2026-07-20 bulletin. [UPGRADED] CVE-2026-45695 (kopia/kopia) — F1: exploitable → functional, AAS: 11.1 → 13.1 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-55579 (pheditor/pheditor) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-54526 (argoproj/argo-workflows) — F1: exploitable → itw, AAS: 9.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-47984 (adobe/commerce) — F1: exploitable → functional, AAS: 10.7 → 14.5 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-57087 (microsoft/windows) — F1: exploitable → itw, AAS: 10.6 → 13.6 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-50313 (microsoft/windows) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-40400 (microsoft/windows) — F1: exploitable → functional, AAS: 9.3 → 11.3 (HIGH → HIGH). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-50306 (microsoft/windows) — F1: exploitable → functional, AAS: 9.1 → 11.1 (HIGH → HIGH). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-58319 (apache/doris) — F1: exploitable → itw, AAS: 10.5 → 13.5 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. 🔴 [CRITICAL] oracle/coherence 52 CVEs | CVSS 3.1: 10.0 | AAS 13.9 ...
23 vulnerabilities across 12 products scored HIGH or above on July 20, 2026. 🟠 HIGH: 23 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-45695 (kopia/kopia) — F1: exploitable → functional, AAS: 11.1 → 13.1 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-55579 (pheditor/pheditor) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-54526 (argoproj/argo-workflows) — F1: exploitable → itw, AAS: 9.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-47984 (adobe/commerce) — F1: exploitable → functional, AAS: 10.7 → 14.5 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-57087 (microsoft/windows) — F1: exploitable → itw, AAS: 10.6 → 13.6 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-50313 (microsoft/windows_10_version_1607) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-40400 (microsoft/windows_10_version_1607) — F1: exploitable → functional, AAS: 9.3 → 11.3 (HIGH → HIGH). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-50306 (microsoft/windows_10_version_1607) — F1: exploitable → functional, AAS: 9.1 → 11.1 (HIGH → HIGH). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-58319 (apache/doris) — F1: exploitable → itw, AAS: 10.5 → 12.0 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. 🟠 [HIGH] rvc-boss/gpt-sovits 1 CVE | CVSS 4.0: 9.3 | AAS 10.7 ...
1 vulnerability across 1 product scored HIGH or above on July 19, 2026. 🟠 HIGH: 1 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-54526 (argoproj/argo-workflows) — F1: exploitable → itw, AAS: 9.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-57087 (microsoft/windows) — F1: exploitable → itw, AAS: 10.6 → 13.6 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-58319 (apache/doris) — F1: exploitable → itw, AAS: 10.5 → 13.5 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. 🟠 [HIGH] fast-uri/fast-uri 1 CVE | CVSS 3.1: 7.5 | AAS 9.6 ...
2 vulnerabilities across 2 products scored HIGH or above on July 18, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 1 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-54526 (argoproj/argo-workflows) — F1: exploitable → itw, AAS: 9.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-57087 (microsoft/windows) — F1: exploitable → itw, AAS: 10.6 → 13.6 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-58319 (apache/doris) — F1: exploitable → itw, AAS: 10.5 → 13.5 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. 🔴 [CRITICAL] surrealdb/surrealdb 1 CVE | CVSS 4.0: 9.4 | AAS 12.3 ...
17 vulnerabilities across 8 products scored HIGH or above on July 17, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 16 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-57219 (rabbitmq/rabbitmq_server) — F1: theoretical → itw, AAS: 10.9 → 13.7 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55884 (tilt-dev/tilt) — F1: exploitable → itw, AAS: 10.3 → 13.0 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55879 (openreplay/openreplay) — F1: exploitable → itw, AAS: 10.3 → 13.3 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. 🔴 [CRITICAL] wordpress/wordpress 1 CVE | CVSS 3.1: 9.8 | AAS 15.7 ...
17 vulnerabilities across 15 products scored HIGH or above on July 16, 2026. 🟠 HIGH: 17 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-57219 (rabbitmq/rabbitmq_server) — F1: theoretical → itw, AAS: 10.9 → 13.7 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55884 (tilt-dev/tilt) — F1: exploitable → itw, AAS: 10.3 → 13.0 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55879 (openreplay/openreplay) — F1: exploitable → itw, AAS: 10.3 → 13.3 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-54003 (getkirby/kirby) — F1: theoretical → poc, AAS: 11.8 → 11.5 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59827 (metabase/metabase) — F1: exploitable → itw, AAS: 11.2 → 13.1 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59148 (mockoon/mockoon) — F1: exploitable → itw, AAS: 9.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59858 (vim/vim) — F1: exploitable → itw, AAS: 9.3 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-55207 (pimcore/pimcore) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-07-09 bulletin. 🟠 [HIGH] kopia/kopia 1 CVE | CVSS 3.1: 9.8 | AAS 11.1 ...
23 vulnerabilities across 15 products scored HIGH or above on July 15, 2026. 🔴 CRITICAL: 2 🟠 HIGH: 21 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-57219 (rabbitmq/rabbitmq_server) — F1: theoretical → itw, AAS: 10.9 → 13.7 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55884 (tilt-dev/tilt) — F1: exploitable → itw, AAS: 10.3 → 13.0 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55879 (openreplay/openreplay) — F1: exploitable → itw, AAS: 10.3 → 13.3 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-54003 (getkirby/kirby) — F1: theoretical → poc, AAS: 11.8 → 11.5 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59827 (metabase/metabase) — F1: exploitable → itw, AAS: 11.2 → 13.1 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59148 (mockoon/mockoon) — F1: exploitable → itw, AAS: 9.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59858 (vim/vim) — F1: exploitable → itw, AAS: 9.3 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-55207 (pimcore/pimcore) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-57480 (parse-community/parse-server) — F1: theoretical → poc, AAS: 9.8 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-08 bulletin. 🔴 [CRITICAL] wazuh/wazuh 1 CVE | CVSS 4.0: 10.0 | AAS 13.1 ...
148 vulnerabilities across 15 products scored HIGH or above on July 14, 2026. 🔴 CRITICAL: 6 🟠 HIGH: 142 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-57219 (rabbitmq/rabbitmq_server) — F1: theoretical → itw, AAS: 10.9 → 13.7 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55884 (tilt-dev/tilt) — F1: exploitable → itw, AAS: 10.3 → 13.0 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55879 (openreplay/openreplay) — F1: exploitable → itw, AAS: 10.3 → 13.3 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-54003 (getkirby/kirby) — F1: theoretical → poc, AAS: 11.8 → 11.5 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59827 (metabase/metabase) — F1: exploitable → itw, AAS: 11.2 → 13.1 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59148 (mockoon/mockoon) — F1: exploitable → itw, AAS: 9.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59858 (vim/vim) — F1: exploitable → itw, AAS: 9.3 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-55207 (pimcore/pimcore) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-57480 (parse-community/parse-server) — F1: theoretical → poc, AAS: 9.8 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-08 bulletin. [UPGRADED] CVE-2026-59705 (mem0ai/mem0) — F1: exploitable → itw, AAS: 10.7 → 12.9 (HIGH → CRITICAL). Originally in 2026-07-07 bulletin. [UPGRADED] CVE-2026-53511 (kovidgoyal/calibre) — F1: exploitable → itw, AAS: 9.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-07-07 bulletin. 🔴 [CRITICAL] adobe/coldfusion 1 CVE | CVSS 3.1: 10.0 | AAS 14.3 ...