Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 4 to 10 May 2026 (week 19)
Final report, published . It does not change.
In the week of 4 to 10 May 2026, 3 vulnerabilities were newly recorded as exploited in the wild, 3 of them critical. The technology hit most was Berriai LiteLLM (1), followed by Ivanti Endpoint Manager Mobile (1) and Ivanti Endpoint Manager Mobile (EPMM) (1).
- Newly exploited
- 3
- Critical
- 3
- Technologies hit
- 15
Newly exploited this week
- CVE-2026-42208: BerriAI LiteLLM SQL injection in Proxy API key verificationcriticalCVSS 9.8Exploited since Published Berriai LiteLLM, litellm (PyPI)
- CVE-2026-6973: Ivanti Endpoint Manager Mobile RCE via Apache directive injectioncriticalCVSS 7.2Exploited since Published Ivanti Endpoint Manager Mobile, Ivanti Endpoint Manager Mobile (EPMM), Ivanti MobileIron Core
- CVE-2026-0300: Palo Alto Networks PAN-OS buffer overflow in User-ID Authentication PortalcriticalCVSS 9.8Exploited since Published Paloaltonetworks Pa-1410, Paloaltonetworks Pa-1420, Paloaltonetworks Pa-3410
Technologies hit most
- 1.Berriai LiteLLM1 vulnerability
- 2.Ivanti Endpoint Manager Mobile1 vulnerability
- 3.Ivanti Endpoint Manager Mobile (EPMM)1 vulnerability
- 4.Ivanti MobileIron Core1 vulnerability
- 5.litellm (PyPI)1 vulnerability
- 6.Paloaltonetworks Pa-14101 vulnerability
- 7.Paloaltonetworks Pa-14201 vulnerability
- 8.Paloaltonetworks Pa-34101 vulnerability
- 9.Paloaltonetworks Pa-34201 vulnerability
- 10.Paloaltonetworks Pa-34301 vulnerability
- 11.Paloaltonetworks Pa-34401 vulnerability
- 12.Paloaltonetworks Pa-4101 vulnerability
- 13.Paloaltonetworks Pa-410r1 vulnerability
- 14.Paloaltonetworks Pa-410r-5g1 vulnerability
- 15.Paloaltonetworks Pa-4151 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-05-04.json, and this page as text at https://junglewise.ai/threats/exploited/2026-05-04.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 4 to 10 May 2026 (week 19)", https://junglewise.ai/threats/exploited/2026-05-04, 2 October 2026.