Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
19 vulnerabilities across 15 products scored HIGH or above on July 02, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 18 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-52785 (opf/openproject) — F1: exploitable → functional, AAS: 11.1 → 13.1 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-45405 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 12.8 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-54636 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 13.9 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-52884 (notepad-plus-plus/notepad) — F1: exploitable → functional, AAS: 9.1 → 11.1 (HIGH → HIGH). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-54825 (wpdatatables/wpdatatables) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-06-26 bulletin. 🔴 [CRITICAL] craftcms/cms 2 CVEs | CVSS 4.0: 8.7 | AAS 12.8 ...
41 vulnerabilities across 14 products scored HIGH or above on July 01, 2026. 🟠 HIGH: 41 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-52785 (opf/openproject) — F1: exploitable → functional, AAS: 11.1 → 13.1 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-45405 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 12.8 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-54636 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 13.9 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-52884 (notepad-plus-plus/notepad) — F1: exploitable → functional, AAS: 9.1 → 11.1 (HIGH → HIGH). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-54825 (wpdatatables/wpdatatables) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-50189 (appsmith/appsmith) — F1: exploitable → functional, AAS: 9.7 → 10.8 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-54067 (siyuan-note/siyuan) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-52794 (sentry/sentry) — F1: exploitable → itw, AAS: 9.3 → 10.9 (HIGH → HIGH). Originally in 2026-06-24 bulletin. 🟠 [HIGH] google/chrome 25 CVEs | CVSS 3.1: 9.6 | AAS 11.4 ...
31 vulnerabilities across 15 products scored HIGH or above on June 30, 2026. 🟣 EMERGENCY: 5 🔴 CRITICAL: 14 🟠 HIGH: 12 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-52785 (opf/openproject) — F1: exploitable → functional, AAS: 11.1 → 13.1 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-45405 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 12.8 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-54636 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 13.9 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-52884 (notepad-plus-plus/notepad) — F1: exploitable → functional, AAS: 9.1 → 11.1 (HIGH → HIGH). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-54825 (wpdatatables/wpdatatables) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-50189 (appsmith/appsmith) — F1: exploitable → functional, AAS: 9.7 → 10.8 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-54067 (siyuan-note/siyuan) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-52794 (sentry/sentry) — F1: exploitable → itw, AAS: 9.3 → 10.9 (HIGH → HIGH). Originally in 2026-06-24 bulletin. 🟣 [EMERGENCY] adobe/coldfusion 9 CVEs | CVSS 3.1: 10.0 | AAS 16.3 ...
8 vulnerabilities across 6 products scored HIGH or above on June 29, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 7 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-52785 (opf/openproject) — F1: exploitable → functional, AAS: 11.1 → 13.1 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-45405 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 12.8 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-54636 (dokku/dokku) — F1: exploitable → itw, AAS: 10.3 → 13.9 (HIGH → CRITICAL). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-52884 (notepad-plus-plus/notepad) — F1: exploitable → functional, AAS: 9.1 → 11.1 (HIGH → HIGH). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-54825 (wpdatatables/wpdatatables) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-06-26 bulletin. [UPGRADED] CVE-2026-50189 (appsmith/appsmith) — F1: exploitable → functional, AAS: 9.7 → 10.8 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-54067 (siyuan-note/siyuan) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-52794 (sentry/sentry) — F1: exploitable → itw, AAS: 9.3 → 10.9 (HIGH → HIGH). Originally in 2026-06-24 bulletin. 🔴 [CRITICAL] coollabsio/coolify 3 CVEs | CVSS 3.1: 9.6 | AAS 12.7 ...
2 vulnerabilities across 2 products scored HIGH or above on June 28, 2026. 🟠 HIGH: 2 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-50189 (appsmith/appsmith) — F1: exploitable → functional, AAS: 9.7 → 10.8 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-54067 (siyuan-note/siyuan) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-06-24 bulletin. 🟠 [HIGH] ffmpeg/ffmpeg 1 CVE | CVSS 4.0: 8.8 | AAS 10.2 ...
29 vulnerabilities across 15 products scored HIGH or above on June 26, 2026. 🔴 CRITICAL: 6 🟠 HIGH: 23 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-50189 (appsmith/appsmith) — F1: exploitable → functional, AAS: 9.7 → 10.8 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-54067 (siyuan-note/siyuan) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-06-24 bulletin. 🔴 [CRITICAL] jdx/mise 2 CVEs | CVSS 3.1: 9.6 | AAS 14.5 ...
29 vulnerabilities across 15 products scored HIGH or above on June 25, 2026. 🟣 EMERGENCY: 4 🔴 CRITICAL: 6 🟠 HIGH: 19 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-50189 (appsmithorg/appsmith) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-06-24 bulletin. [UPGRADED] CVE-2026-54067 (siyuan-note/siyuan) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-06-24 bulletin. 🟣 [EMERGENCY] flowise/flowise 6 CVEs | CVSS 4.0: 10.0 | AAS 16.0 ...
48 vulnerabilities across 15 products scored HIGH or above on June 24, 2026. 🔴 CRITICAL: 20 🟠 HIGH: 28 🔴 [CRITICAL] tryghost/ghost 1 CVE | CVSS 3.1: 9.6 | AAS 15.5 cpe:2.3:a:tryghost:ghost:*:*:*:*:*:*:*:* Ghost CMS by TryGhost is affected by a critical cache poisoning vulnerability (CVE-2026-53943, CVSS 9.6) in versions prior to 6.37.0. An unauthenticated attacker can manipulate the x-ghost-preview header to inject altered content into shared caching layers, causing poisoned responses to be served to all subsequent visitors of the same page. A proof-of-concept exploit is publicly available. ...
9 vulnerabilities across 3 products scored HIGH or above on June 23, 2026. 🟠 HIGH: 9 🟠 [HIGH] gogs.io/gogs 6 CVEs | CVSS 3.1: 10.0 | AAS 11.8 cpe:2.3:a:gogs.io:gogs:*:*:*:*:*:*:*:* Gogs, the self-hosted Git service from gogs.io, is affected by six vulnerabilities, including at least one critical-severity issue carrying a CVSS score of 10.0. The most severe flaw allows an attacker to exploit path traversal in organization names to write repositories to arbitrary filesystem locations, ultimately achieving remote code execution by overwriting Git hook configurations. Security teams running self-hosted Gogs instances should treat this as an urgent priority, review the vendor advisory at the linked GitHub Security Advisory page, and apply patches or mitigations as soon as they become available. ...
23 vulnerabilities across 14 products scored HIGH or above on June 22, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 22 🔴 [CRITICAL] phpoffice/phpspreadsheet 1 CVE | CVSS 4.0: 9.2 | AAS 12.5 cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* PHPOffice PhpSpreadsheet, a widely used PHP library for reading and writing spreadsheet files, is affected by a critical severity vulnerability (CVE-2026-45034, CVSS 9.2) that bypasses a prior security fix for stream wrapper restrictions. An attacker can craft malicious file paths with additional slashes to evade the wrapper prohibition check, potentially enabling exploitation through dangerous PHP stream wrappers such as phar://, php://, or expect://. A functional exploit is available, making this an urgent priority for any team running applications that use PhpSpreadsheet to process user-supplied files. ...