Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
No EMERGENCY vulnerabilities this month.
44 vulnerabilities across 15 products scored HIGH or above on August 20, 2026. 🔴 CRITICAL: 2 🟠 HIGH: 42 🔴 [CRITICAL] spip/spip 1 CVE | CVSS 3.1: 9.8 | AAS 13.9 cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:* (< 4.4.20) SPIP — Critical Remote Code Execution Exploited in the Wild SPIP versions prior to 4.4.20 are affected by a critical unauthenticated remote code execution vulnerability (CVE-2026-77647, CVSS 9.8). The flaw stems from incorrect handling of PHP code blocks and unsafe use of var_export, allowing remote attackers to execute arbitrary code without authentication. This vulnerability is confirmed to be actively exploited in the wild as of August 2026. All organizations running SPIP-based websites should treat this as an emergency update. Upgrade to SPIP 4.4.20 or later immediately and review systems for signs of compromise. Refer to the vendor advisory at blog.spip.net for full details. ...
62 vulnerabilities across 15 products scored HIGH or above on August 19, 2026. 🟠 HIGH: 62 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. 🟠 [HIGH] ibm/aix 21 CVEs | CVSS 3.1: 9.9 | AAS 11.9 cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:* (>= 7.2.5, <= 7.2.5.212) cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:* (>= 7.3.2, <= 7.3.2.5) cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:* (>= 7.3.3, <= 7.3.3.2) cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:* (>= 7.3.4, <= 7.3.4.1) cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:* (>= 4.1.0, < 4.1.0.50) IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, are affected by 21 vulnerabilities, including multiple critical issues with CVSS scores up to 9.9. The most severe flaw allows remote attackers to execute arbitrary code through improper validation of network-supplied pointers, and exploitation is considered feasible. Administrators running AIX or PowerVM VIOS in their environments should prioritize patching immediately by reviewing the vendor advisory at https://www.ibm.com/support/pages/node/7283858 and applying all available fixes. ...
31 vulnerabilities across 15 products scored HIGH or above on August 18, 2026. 🔴 CRITICAL: 7 🟠 HIGH: 24 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. 🔴 [CRITICAL] oracle_corporation/oracle_weblogic_server 7 CVEs | CVSS 3.1: 9.9 | AAS 12.9 cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 12.2.1.4.0) cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 14.1.1.0.0) cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 14.1.2.0.0) cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 15.1.1.0.0) cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 12.2.1.4.0, < 12.2.1.4.0) Oracle WebLogic Server is affected by seven vulnerabilities disclosed in the August 2026 Critical Patch Update, including multiple critical-severity flaws. The most severe, carrying a CVSS score of 9.8, allows an unauthenticated attacker with network access via IIOP to fully compromise WebLogic Server without any user interaction. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Organizations running Oracle WebLogic Server in any capacity should prioritize applying the patches from Oracle’s August 2026 security advisory immediately, and as an interim measure consider restricting network access to IIOP endpoints. ...
19 vulnerabilities across 15 products scored HIGH or above on August 17, 2026. 🔴 CRITICAL: 2 🟠 HIGH: 17 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. 🔴 [CRITICAL] patriksimek/vm2 2 CVEs | CVSS 3.1: 9.9 | AAS 12.8 ...
13 vulnerabilities across 6 products scored HIGH or above on August 16, 2026. 🟠 HIGH: 13 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. 🟠 [HIGH] prosolution/prosolution_wp_client 2 CVEs | CVSS 3.1: 9.8 | AAS 10.9 ...
5 vulnerabilities across 5 products scored HIGH or above on August 15, 2026. 🟠 HIGH: 5 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. 🟠 [HIGH] sixstorage/6storage_rentals 1 CVE | CVSS 3.1: 9.8 | AAS 10.9 ...
12 vulnerabilities across 7 products scored HIGH or above on August 14, 2026. 🟠 HIGH: 12 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-71558 (apache/fory) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-62873 (microsoft/microsoft_365_admin_center) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-08-07 bulletin. 🟠 [HIGH] laravel/socialite 1 CVE | CVSS 4.0: 9.2 | AAS 10.6 ...
38 vulnerabilities across 15 products scored HIGH or above on August 13, 2026. 🔴 CRITICAL: 18 🟠 HIGH: 20 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin. [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-71558 (apache/fory) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-62873 (microsoft/microsoft_365_admin_center) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-65507 (flavor/aiwu) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-5430 (wso2/api_control_plane) — F1: theoretical → poc, AAS: 10.7 → 13.2 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-34191 (apache/apr-util) — F1: exploitable → functional, AAS: 10.5 → 13.7 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-28139 (ajax_search_lite/ajax_search_lite) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2025-15039 (wso2/api_control_plane) — F1: theoretical → itw, AAS: 9.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-65583 (apache/cxf) — F1: exploitable → functional, AAS: 9.9 → 11.9 (HIGH → HIGH). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-68079 (apache/cxf) — F1: theoretical → poc, AAS: 9.6 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. 🔴 [CRITICAL] miniorange/miniorange_otp_verification 1 CVE | CVSS 3.1: 9.8 | AAS 12.9 ...
30 vulnerabilities across 15 products scored HIGH or above on August 12, 2026. 🔴 CRITICAL: 11 🟠 HIGH: 19 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-71558 (apache/fory) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-62873 (microsoft/microsoft_365_admin_center) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-65507 (flavor/aiwu) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-5430 (wso2/api_control_plane) — F1: theoretical → poc, AAS: 10.7 → 13.2 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-34191 (apache/apr-util) — F1: exploitable → functional, AAS: 10.5 → 13.7 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-28139 (ajax_search_lite/ajax_search_lite) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2025-15039 (wso2/api_control_plane) — F1: theoretical → itw, AAS: 9.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-65583 (apache/cxf) — F1: exploitable → functional, AAS: 9.9 → 11.9 (HIGH → HIGH). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-68079 (apache/cxf) — F1: theoretical → poc, AAS: 9.6 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-48168 (mervinpraison/praisonai) — F1: exploitable → functional, AAS: 10.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-08-05 bulletin. 🔴 [CRITICAL] fortinet/fortiweb 1 CVE | CVSS 3.1: 9.8 | AAS 14.9 ...
113 vulnerabilities across 15 products scored HIGH or above on August 11, 2026. 🟣 EMERGENCY: 1 🔴 CRITICAL: 47 🟠 HIGH: 65 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin. [UPGRADED] CVE-2026-71558 (apache/fory) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-62873 (microsoft/microsoft_365_admin_center) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-08-07 bulletin. [UPGRADED] CVE-2026-65507 (flavor/aiwu) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-5430 (wso2/api_control_plane) — F1: theoretical → poc, AAS: 10.7 → 13.2 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-34191 (apache/apr-util) — F1: exploitable → functional, AAS: 10.5 → 13.7 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-28139 (ajax_search_lite/ajax_search_lite) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2025-15039 (wso2/api_control_plane) — F1: theoretical → itw, AAS: 9.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-65583 (apache/cxf) — F1: exploitable → functional, AAS: 9.9 → 11.9 (HIGH → HIGH). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-68079 (apache/cxf) — F1: theoretical → poc, AAS: 9.6 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-06 bulletin. [UPGRADED] CVE-2026-48168 (mervinpraison/praisonai) — F1: exploitable → functional, AAS: 10.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-08-05 bulletin. [UPGRADED] CVE-2026-70478 (flowiseai/flowise) — F1: theoretical → poc, AAS: 9.9 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-04 bulletin. 🟣 [EMERGENCY] adobe/coldfusion_2025 5 CVEs | CVSS 3.1: 10.0 | AAS 16.8 ...