Daily curated vulnerability bulletins from ARETIQ AI. Each bulletin highlights the day’s most critical vulnerabilities, ranked by real-world risk — not just CVSS scores.
Ranked by AAS (ARETIQ Adjusted Score) — a real-world risk score that considers exploit maturity, deployment scale, asset criticality, and remediation status.
Subscribe via JSON feed.
No EMERGENCY vulnerabilities this month.
8 vulnerabilities across 4 products scored HIGH or above on November 06, 2026. 🟠 HIGH: 8 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-119977 (wordpress/wordpress) — F1: exploitable → itw, AAS: 10.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-10-31 bulletin. 🟠 [HIGH] chartbrew/chartbrew 4 CVEs | CVSS 3.1: 9.8 | AAS 10.9 cpe:2.3:a:chartbrew:chartbrew:*:*:*:*:*:*:*:* (>= 4.8.5, < 5.2.3) Chartbrew, the open-source database and API charting platform, is affected by four vulnerabilities, including multiple critical-severity issues (CVSS 9.8). The most severe flaws involve unsafe SQL dashboard-variable substitution in the applyMysqlOrPostgresVariables function, where attacker-controlled input is processed without proper sanitization across SQL connectors, and backslashes are not escaped in MySQL and MariaDB quoted contexts. These vulnerabilities are exploitable by unauthenticated users through public and embedded dashboard or chart requests, making any internet-facing Chartbrew deployment an immediate target. ...
40 vulnerabilities across 15 products scored HIGH or above on November 05, 2026. 🔴 CRITICAL: 4 🟠 HIGH: 36 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-119977 (wordpress/wordpress) — F1: exploitable → itw, AAS: 10.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-10-31 bulletin. 🔴 [CRITICAL] apache_software_foundation/apache_ofbiz 6 CVEs | CVSS 3.1: 9.8 | AAS 13.4 cpe:2.3:a:apache:apache_ofbiz:*:*:*:*:*:*:*:* Apache OFBiz versions prior to 24.09.08 are affected by six vulnerabilities, including multiple critical-severity flaws with a maximum CVSS score of 9.8. The most severe is a remote code execution vulnerability that allows an unauthenticated attacker to execute arbitrary code on the server by chaining a multipart file upload with a widget XML override, ultimately triggering unsandboxed Groovy expression evaluation. A functional exploit is available, making this an immediate patching priority. ...
22 vulnerabilities across 11 products scored HIGH or above on November 04, 2026. 🟠 HIGH: 22 🟠 [HIGH] crocoblock/jetformbuilder 1 CVE | CVSS 3.1: 9.8 | AAS 10.8 cpe:2.3:a:crocoblock:jetformbuilder:*:*:*:*:*:*:*:* (< 3.6.7.2) Crocoblock JetFormBuilder, a WordPress form plugin, is affected by one critical vulnerability (CVE-2026-119481, CVSS 9.8) involving incorrect privilege assignment that allows attackers to escalate privileges on affected sites. All installations running JetFormBuilder versions up through 3.6.7.1 are affected, and the flaw is considered exploitable. WordPress administrators using this plugin should update immediately to a patched version and review their sites for signs of unauthorized privilege changes; see the Patchstack advisory for full details and remediation guidance. ...
87 vulnerabilities across 5 products scored HIGH or above on November 03, 2026. 🟠 HIGH: 87 🟠 [HIGH] codeskyblue/gohttpserver 1 CVE | CVSS 3.1: 9.8 | AAS 11.9 cpe:2.3:a:codeskyblue:gohttpserver:*:*:*:*:*:*:*:* (< 1.3.1) codeskyblue gohttpserver through version 1.3.0 is affected by one critical-severity vulnerability (CVSS 9.8). CVE-2026-38600 is a Zip Slip flaw in the /upload endpoint that allows attackers to write arbitrary files outside the intended directory by uploading a specially crafted Zip archive, potentially leading to remote code execution. Organizations running gohttpserver should treat this as urgent — the vulnerability is exploitable, requires no authentication, and can result in full system compromise. Administrators should check the vendor advisory at the link above for remediation guidance and upgrade or restrict access to the upload endpoint immediately. ...
25 vulnerabilities across 10 products scored HIGH or above on November 02, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 24 🔴 [CRITICAL] control_web_panel/control_web_panel 5 CVEs | CVSS 4.0: 8.6 | AAS 12.0 cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:* Control Web Panel (CWP) is affected by five vulnerabilities, including at least one critical-severity authentication bypass (CVSS 8.6) that allows unauthenticated attackers to reach protected user panel functionality by exploiting a missing exit call after a redirect in the authentication flow. Organizations running CWP versions prior to 1.12 should treat this as an urgent priority, as the lead vulnerability requires no authentication and has confirmed exploitability. ...
1 vulnerability across 1 product scored HIGH or above on November 01, 2026. 🟠 HIGH: 1 🟠 [HIGH] liquid_web_/_stellarwp/bookit 1 CVE | CVSS 3.1: 9.3 | AAS 10.3 cpe:2.3:a:liquid_web_stellarwp:bookit:*:*:*:*:*:*:*:* (< 2.6.0.7) Liquid Web / StellarWP BookIt, a WordPress appointment booking plugin, is affected by one critical SQL injection vulnerability (CVE-2026-62048, CVSS 9.3 HIGH) in all versions through 2.6.0.6. This flaw allows attackers to inject malicious SQL commands, potentially leading to unauthorized database access, data exfiltration, or full site compromise, and is considered exploitable. ...
9 vulnerabilities across 9 products scored HIGH or above on October 31, 2026. 🟠 HIGH: 9 🟠 [HIGH] wordpress_foundation/wordpress 1 CVE | CVSS 3.1: 8.1 | AAS 10.2 cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (>= 4.7, < 7.1.4) WordPress Core — HIGH Severity (CVSS 8.1) One vulnerability affects WordPress Core versions 4.7 through 7.1.3 involving remote code execution due to predictable, web-accessible staging paths used during full-package core upgrades. An unauthenticated attacker can exploit this during the upgrade window to execute arbitrary code on the server. Given WordPress’s massive install base, this is relevant to virtually every organization running self-hosted WordPress. Administrators should update to WordPress 7.1.4 or later immediately, avoid performing core upgrades on internet-facing instances without additional access controls, and review server logs for any suspicious activity during recent upgrade windows. See the vendor advisory at core.trac.wordpress.org for technical details. ...
19 vulnerabilities across 15 products scored HIGH or above on October 30, 2026. 🔴 CRITICAL: 1 🟠 HIGH: 18 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-115893 (bytecodealliance/wasmtime) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-10-23 bulletin. 🔴 [CRITICAL] clickhouse/clickhouse 1 CVE | CVSS 4.0: 9.5 | AAS 12.1 cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:* ClickHouse Server is affected by a critical remote code execution vulnerability (CVE-2026-116366, CVSS 9.5) that allows an unauthenticated attacker with network access to execute arbitrary code under certain conditions. A functional exploit is available, significantly increasing the risk of active exploitation. Organizations running ClickHouse Server should immediately consult the vendor security changelog at clickhouse.com and apply available patches or mitigations without delay. ...
41 vulnerabilities across 15 products scored HIGH or above on October 29, 2026. 🔴 CRITICAL: 8 🟠 HIGH: 33 Exploit Status Upgrades The following CVEs from previous bulletins have been upgraded based on new exploit intelligence: [UPGRADED] CVE-2026-115893 (bytecodealliance/wasmtime) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-10-23 bulletin. 🔴 [CRITICAL] langflow/langflow 16 CVEs | CVSS 3.1: 9.8 | AAS 14.9 cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:* (>= 1.0.0, < 1.13.0) Langflow versions 1.0.0 through 1.12.8 are affected by 16 vulnerabilities, including multiple critical-severity issues with CVSS scores up to 9.8. The most severe flaw allows a remote attacker to bypass authentication and security restrictions without prior access, and proof-of-concept exploit code is available. Organizations running Langflow in any capacity, particularly internet-facing deployments, should treat this as an urgent priority given the authentication bypass nature of the lead vulnerability and the breadth of issues disclosed. Security teams should review the IBM advisory at the link above, upgrade to a patched release immediately, and audit logs for signs of unauthorized access. ...
18 vulnerabilities across 15 products scored HIGH or above on October 28, 2026. 🟠 HIGH: 18 🟠 [HIGH] fasterxml/jackson-databind 1 CVE | CVSS 3.1: 9.8 | AAS 11.9 cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* FasterXML jackson-databind is affected by one critical vulnerability (CVE-2026-110879, CVSS 9.8) involving a bypass of generic-argument type validation during polymorphic deserialization. An attacker can supply crafted class names within generic type arguments that evade the outer-class validation checks, effectively circumventing the earlier fix for CVE-2026-54512. This is an incomplete fix bypass and is considered exploitable. ...