Junglewise

Threat intelligence · exploited in the wild

Vulnerabilities exploited in the wild

Updated . Rebuilt every hour.

Junglewise Threat Intelligence tracks 1,779 vulnerabilities known to be exploited in the wild, from the CISA Known Exploited Vulnerabilities catalogue and vendor advisories: 11 newly exploited in the last 7 days, 38 in the last 30 days and 320 in the last year. The most recent, CVE-2026-125350, was first recorded as exploited on 10 November 2026. The technology hit most in the last 30 days was Plex Media Server, with 4 vulnerabilities.

Newly exploited, 7 days
11
Newly exploited, 30 days
38
Newly exploited, 1 year
320
All time
1,779

Newly exploited this week (from 9 November 2026)

Newly exploited in the last 30 days

Technologies hit most in the last 30 days

  1. 1.Plex Media Server4 vulnerabilities
  2. 2.Amazon AWS3 vulnerabilities
  3. 3.Google Cloud Platform3 vulnerabilities
  4. 4.AhsayCBS2 vulnerabilities
  5. 5.Ivanti Connect Secure2 vulnerabilities
  6. 6.PHP Group PHP2 vulnerabilities
  7. 7.Adobe Commerce1 vulnerability
  8. 8.Adobe Commerce B2B1 vulnerability
  9. 9.Adobe Commerce Webhooks Plugin1 vulnerability
  10. 10.Adobe Magento1 vulnerability
  11. 11.Adobe Magento Enterprise Edition1 vulnerability
  12. 12.Adobe Magento Open Source1 vulnerability
  13. 13.Apple Ios1 vulnerability
  14. 14.Apple iPadOS1 vulnerability
  15. 15.Apple macOS1 vulnerability

Weekly reports

One frozen report per week in which something was newly exploited.

Every vulnerability exploited in the wild

1,779 vulnerabilities, newest first, by the year each was first recorded as exploited.

2026 (295 vulnerabilities)
2025 (245 vulnerabilities)
2024 (186 vulnerabilities)
2023 (187 vulnerabilities)
2022 (555 vulnerabilities)
2021 (311 vulnerabilities)

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/exploited.json, and this page as text at https://junglewise.ai/threats/exploited.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "Vulnerabilities exploited in the wild", https://junglewise.ai/threats/exploited, 13 November 2026.