Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
No EMERGENCY vulnerabilities this month.
1 vulnerability across 1 product scored HIGH or above on July 19, 2026. 🟠 HIGH: 1 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-54526 (argoproj/argo-workflows) — F1: exploitable → itw, AAS: 9.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-57087 (microsoft/windows) — F1: exploitable → itw, AAS: 10.6 → 13.6 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-58319 (apache/doris) — F1: exploitable → itw, AAS: 10.5 → 13.5 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. 🟠 [HIGH] fast-uri/fast-uri 1 CVE | CVSS 3.1: 7.5 | AAS 9.6 ...
2 vulnerabilities across 2 products scored HIGH or above on July 18, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 1 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-54526 (argoproj/argo-workflows) — F1: exploitable → itw, AAS: 9.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin. [UPGRADED] CVE-2026-57087 (microsoft/windows) — F1: exploitable → itw, AAS: 10.6 → 13.6 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. [UPGRADED] CVE-2026-58319 (apache/doris) — F1: exploitable → itw, AAS: 10.5 → 13.5 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin. 🔴 [CRITICAL] surrealdb/surrealdb 1 CVE | CVSS 4.0: 9.4 | AAS 12.3 ...
17 vulnerabilities across 8 products scored HIGH or above on July 17, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 16 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-57219 (rabbitmq/rabbitmq_server) — F1: theoretical → itw, AAS: 10.9 → 13.7 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55884 (tilt-dev/tilt) — F1: exploitable → itw, AAS: 10.3 → 13.0 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55879 (openreplay/openreplay) — F1: exploitable → itw, AAS: 10.3 → 13.3 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. 🔴 [CRITICAL] wordpress/wordpress 1 CVE | CVSS 3.1: 9.8 | AAS 15.7 ...
17 vulnerabilities across 15 products scored HIGH or above on July 16, 2026. 🟠 HIGH: 17 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-57219 (rabbitmq/rabbitmq_server) — F1: theoretical → itw, AAS: 10.9 → 13.7 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55884 (tilt-dev/tilt) — F1: exploitable → itw, AAS: 10.3 → 13.0 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55879 (openreplay/openreplay) — F1: exploitable → itw, AAS: 10.3 → 13.3 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-54003 (getkirby/kirby) — F1: theoretical → poc, AAS: 11.8 → 11.5 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59827 (metabase/metabase) — F1: exploitable → itw, AAS: 11.2 → 13.1 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59148 (mockoon/mockoon) — F1: exploitable → itw, AAS: 9.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59858 (vim/vim) — F1: exploitable → itw, AAS: 9.3 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-55207 (pimcore/pimcore) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-07-09 bulletin. 🟠 [HIGH] kopia/kopia 1 CVE | CVSS 3.1: 9.8 | AAS 11.1 ...
23 vulnerabilities across 15 products scored HIGH or above on July 15, 2026. 🔴 CRITICAL: 2 🟠 HIGH: 21 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-57219 (rabbitmq/rabbitmq_server) — F1: theoretical → itw, AAS: 10.9 → 13.7 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55884 (tilt-dev/tilt) — F1: exploitable → itw, AAS: 10.3 → 13.0 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55879 (openreplay/openreplay) — F1: exploitable → itw, AAS: 10.3 → 13.3 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-54003 (getkirby/kirby) — F1: theoretical → poc, AAS: 11.8 → 11.5 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59827 (metabase/metabase) — F1: exploitable → itw, AAS: 11.2 → 13.1 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59148 (mockoon/mockoon) — F1: exploitable → itw, AAS: 9.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59858 (vim/vim) — F1: exploitable → itw, AAS: 9.3 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-55207 (pimcore/pimcore) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-57480 (parse-community/parse-server) — F1: theoretical → poc, AAS: 9.8 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-08 bulletin. 🔴 [CRITICAL] wazuh/wazuh 1 CVE | CVSS 4.0: 10.0 | AAS 13.1 ...
148 vulnerabilities across 15 products scored HIGH or above on July 14, 2026. 🔴 CRITICAL: 6 🟠 HIGH: 142 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-57219 (rabbitmq/rabbitmq_server) — F1: theoretical → itw, AAS: 10.9 → 13.7 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55884 (tilt-dev/tilt) — F1: exploitable → itw, AAS: 10.3 → 13.0 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55879 (openreplay/openreplay) — F1: exploitable → itw, AAS: 10.3 → 13.3 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-54003 (getkirby/kirby) — F1: theoretical → poc, AAS: 11.8 → 11.5 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59827 (metabase/metabase) — F1: exploitable → itw, AAS: 11.2 → 13.1 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59148 (mockoon/mockoon) — F1: exploitable → itw, AAS: 9.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59858 (vim/vim) — F1: exploitable → itw, AAS: 9.3 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-55207 (pimcore/pimcore) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-57480 (parse-community/parse-server) — F1: theoretical → poc, AAS: 9.8 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-08 bulletin. [UPGRADED] CVE-2026-59705 (mem0ai/mem0) — F1: exploitable → itw, AAS: 10.7 → 12.9 (HIGH → CRITICAL). Originally in 2026-07-07 bulletin. [UPGRADED] CVE-2026-53511 (kovidgoyal/calibre) — F1: exploitable → itw, AAS: 9.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-07-07 bulletin. 🔴 [CRITICAL] adobe/coldfusion 1 CVE | CVSS 3.1: 10.0 | AAS 14.3 ...
19 vulnerabilities across 15 products scored HIGH or above on July 13, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 18 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-57219 (rabbitmq/rabbitmq_server) — F1: theoretical → itw, AAS: 10.9 → 13.7 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55884 (tilt-dev/tilt) — F1: exploitable → itw, AAS: 10.3 → 13.0 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-55879 (openreplay/openreplay) — F1: exploitable → itw, AAS: 10.3 → 13.3 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-54003 (getkirby/kirby) — F1: theoretical → poc, AAS: 11.8 → 11.5 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59827 (metabase/metabase) — F1: exploitable → itw, AAS: 11.2 → 13.6 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59148 (mockoon/mockoon) — F1: exploitable → itw, AAS: 9.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59858 (vim/vim) — F1: exploitable → itw, AAS: 9.3 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-55207 (pimcore/pimcore) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-57480 (parse-community/parse-server) — F1: theoretical → poc, AAS: 9.8 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-08 bulletin. [UPGRADED] CVE-2026-59705 (mem0ai/mem0) — F1: exploitable → itw, AAS: 10.7 → 12.9 (HIGH → CRITICAL). Originally in 2026-07-07 bulletin. [UPGRADED] CVE-2026-53511 (kovidgoyal/calibre) — F1: exploitable → itw, AAS: 9.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-07-07 bulletin. 🔴 [CRITICAL] themeum/kirki 2 CVEs | CVSS 3.1: 9.8 | AAS 12.1 ...
4 vulnerabilities across 2 products scored HIGH or above on July 12, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 3 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-55884 (tilt-dev/tilt) — F1: exploitable → itw, AAS: 10.3 → 13.0 (HIGH → CRITICAL). Originally in 2026-07-10 bulletin. [UPGRADED] CVE-2026-54003 (getkirby/kirby) — F1: theoretical → poc, AAS: 11.8 → 11.5 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-59858 (vim/vim) — F1: exploitable → itw, AAS: 9.3 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-55207 (pimcore/pimcore) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-57480 (parse-community/parse-server) — F1: theoretical → poc, AAS: 9.8 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-08 bulletin. [UPGRADED] CVE-2026-59705 (mem0ai/mem0) — F1: exploitable → itw, AAS: 10.7 → 12.9 (HIGH → CRITICAL). Originally in 2026-07-07 bulletin. [UPGRADED] CVE-2026-53511 (kovidgoyal/calibre) — F1: exploitable → itw, AAS: 9.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-07-07 bulletin. 🔴 [CRITICAL] flowise/flowise 1 CVE | CVSS 4.0: 9.3 | AAS 13.0 ...
3 vulnerabilities across 1 product scored HIGH or above on July 11, 2026. 🟠 HIGH: 3 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-54003 (getkirby/kirby) — F1: theoretical → poc, AAS: 11.8 → 11.5 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-55207 (pimcore/pimcore) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-57480 (parse-community/parse-server) — F1: theoretical → poc, AAS: 9.8 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-08 bulletin. 🟠 [HIGH] mervinpraison/praisonai 3 CVEs | CVSS 4.0: 10.0 | AAS 10.4 ...
20 vulnerabilities across 15 products scored HIGH or above on July 10, 2026. 🟠 HIGH: 20 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-54003 (getkirby/kirby) — F1: theoretical → poc, AAS: 11.8 → 13.5 (HIGH → CRITICAL). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-55207 (pimcore/pimcore) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-07-09 bulletin. [UPGRADED] CVE-2026-57480 (parse-community/parse-server) — F1: theoretical → poc, AAS: 9.8 → 12.3 (HIGH → CRITICAL). Originally in 2026-07-08 bulletin. [UPGRADED] CVE-2026-55500 (decolua/9router) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-07-06 bulletin. 🟠 [HIGH] jetbrains/intellij_idea 1 CVE | CVSS 3.1: 9.8 | AAS 11.8 ...