Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
No EMERGENCY vulnerabilities this month.
5 vulnerabilities across 5 products scored HIGH or above on August 30, 2026. 🟠 HIGH: 5 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin. 🟠 [HIGH] tw93/pake 1 CVE | CVSS 3.1: 8.8 | AAS 10.6 cpe:2.3:a:tw93:pake:*:*:*:*:*:*:*:* Pake, the open-source tool by tw93 for wrapping web applications into desktop apps via Tauri, is affected by one high-severity vulnerability (CVE-2026-82635, CVSS 8.8). The flaw allows path traversal through unsanitized filenames in the download_file Tauri command, enabling an attacker-controlled script to write arbitrary content to any user-writable location outside the intended Downloads directory. This can lead to code execution by planting malicious files in startup or configuration directories. ...
6 vulnerabilities across 6 products scored HIGH or above on August 29, 2026. 🟠 HIGH: 6 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin. 🟠 [HIGH] coderaiser/cloudcmd 1 CVE | CVSS 4.0: 9.3 | AAS 10.5 cpe:2.3:a:coderaiser:cloudcmd:*:*:*:*:*:*:*:* (< 19.20.2) Cloud Commander by coderaiser, versions prior to 19.20.2, is affected by one critical-severity vulnerability (CVE-2026-82460, CVSS 9.3 HIGH). The flaw is a directory traversal in the REST file-operation and markdown endpoints that allows attackers to read, write, move, or copy arbitrary files outside the intended root directory due to insufficient path normalization. This vulnerability is considered exploitable in the wild. ...
21 vulnerabilities across 15 products scored HIGH or above on August 28, 2026. 🔴 CRITICAL: 3 🟠 HIGH: 18 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin. [UPGRADED] CVE-2026-76904 (geotools/geotools) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-08-21 bulletin. 🔴 [CRITICAL] liquid_web_/_stellarwp/givewp 1 CVE | CVSS 3.1: 10.0 | AAS 13.2 ...
18 vulnerabilities across 13 products scored HIGH or above on August 27, 2026. 🟠 HIGH: 18 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin. [UPGRADED] CVE-2026-76904 (geotools/geotools) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-08-21 bulletin. [UPGRADED] CVE-2026-72843 (evershopcommerce/evershop) — F1: exploitable → functional, AAS: 10.2 → 12.2 (HIGH → CRITICAL). Originally in 2026-08-20 bulletin. 🟠 [HIGH] redis/redis 1 CVE | CVSS 4.0: 9.2 | AAS 11.2 ...
21 vulnerabilities across 15 products scored HIGH or above on August 26, 2026. 🟣 EMERGENCY: 1 🟠 HIGH: 20 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-76904 (geotools/geotools) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-08-21 bulletin. [UPGRADED] CVE-2026-72843 (evershopcommerce/evershop) — F1: exploitable → functional, AAS: 10.2 → 12.2 (HIGH → CRITICAL). Originally in 2026-08-20 bulletin. 🟣 [EMERGENCY] gitea/gitea 1 CVE | CVSS 3.1: 9.8 | AAS 17.2 ...
27 vulnerabilities across 15 products scored HIGH or above on August 25, 2026. 🟠 HIGH: 27 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-76904 (geotools/geotools) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-08-21 bulletin. [UPGRADED] CVE-2026-72843 (evershopcommerce/evershop) — F1: exploitable → functional, AAS: 10.2 → 12.2 (HIGH → CRITICAL). Originally in 2026-08-20 bulletin. 🟠 [HIGH] adobe/adobe_campaign_classic 3 CVEs | CVSS 3.1: 10.0 | AAS 11.7 ...
18 vulnerabilities across 15 products scored HIGH or above on August 24, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 17 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-76904 (geotools/geotools) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-08-21 bulletin. [UPGRADED] CVE-2026-72843 (evershopcommerce/evershop) — F1: exploitable → functional, AAS: 10.2 → 12.2 (HIGH → CRITICAL). Originally in 2026-08-20 bulletin. 🔴 [CRITICAL] oauth2-proxy/oauth2-proxy 1 CVE | CVSS 4.0: 9.3 | AAS 12.5 ...
1 vulnerability across 1 product scored HIGH or above on August 23, 2026. 🟠 HIGH: 1 🟠 [HIGH] ongres/stackgres 1 CVE | CVSS 3.1: 9.9 | AAS 10.2 cpe:2.3:a:ongres:stackgres:*:*:*:*:*:*:*:* Failed to authenticate: OAuth session expired and could not be refreshed 🟠 CVE-2026-78155 (CVSS 3.1: 9.9) Vendor Advisory
14 vulnerabilities across 7 products scored HIGH or above on August 22, 2026. 🟠 HIGH: 14 🟠 [HIGH] netty/netty 1 CVE | CVSS 4.0: 8.7 | AAS 10.6 cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* (< 4.1.137.final) cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* (>= 4.2.0.final, < 4.2.17.final) Netty has one high-severity vulnerability (CVE-2026-62243, CVSS 8.7) affecting netty-handler versions 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final. The flaw disables TLS hostname verification on the OpenSSL client path when a plain X509TrustManager is used and unsafe-based trust-manager wrapping is unavailable, such as on Java 25 and later. This allows a man-in-the-middle attacker to present a certificate for a different hostname and have it accepted, undermining the confidentiality and integrity of encrypted connections. Teams running Netty-based services or clients with OpenSSL TLS providers should upgrade immediately and consult the vendor advisory at the linked GitHub security page for patched versions and mitigation guidance. ...
26 vulnerabilities across 15 products scored HIGH or above on August 21, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 25 🔴 [CRITICAL] spip/spip 1 CVE | CVSS 3.1: 9.8 | AAS 13.9 cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:* SPIP — Critical Remote Code Execution (Exploited in the Wild) SPIP, the open-source content management and publishing system, is affected by one critical vulnerability (CVE-2026-77806, CVSS 9.8) that allows unauthenticated remote attackers to execute arbitrary code via crafted X-Spip-Filtre HTTP request headers due to improper handling in the template analysis function. This vulnerability is actively being exploited in the wild as of August 2026. All organizations running SPIP versions prior to 4.4.21 should treat this as an emergency and upgrade immediately by following the guidance in the vendor’s security advisory at blog.spip.net. ...