Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 18 to 24 May 2026 (week 21)
Final report, published . It does not change.
In the week of 18 to 24 May 2026, 9 vulnerabilities were newly recorded as exploited in the wild, 9 of them critical. The technology hit most was Microsoft Defender (3), followed by Adobe Acrobat (2) and Adobe Reader (2).
- Newly exploited
- 9
- Critical
- 9
- Technologies hit
- 15
Newly exploited this week
- CVE-2026-9082: Drupal Drupal core SQL injection in database abstraction APIcriticalCVSS 9.8Exploited since Published Drupal Ajenti Core, Drupal, Drupal Core
- CVE-2026-34926: Trend Micro Apex One directory traversal in on-premise servercriticalCVSS 6.7Exploited since Published Trend Micro Apex One
- CVE-2025-34291: Langflow CORS misconfiguration enables Account Takeover and RCEcriticalCVSS 8.8Exploited since Published Trend Micro Apex One, Langflow, langflow (PyPI)
- CVE-2026-45498: Microsoft Defender denial of servicecriticalCVSS 4Exploited since Published Microsoft Defender
- CVE-2026-41091: Microsoft Defender privilege escalation via improper link resolutioncriticalCVSS 7.8Exploited since Published Microsoft Defender
- CVE-2009-1537: Microsoft DirectX NULL byte overwrite in QuickTime Movie Parser FiltercriticalCVSS 9.3Exploited since Published Microsoft DirectX, Microsoft Windows 2000, Microsoft Windows Server 2003
- CVE-2009-3459: Adobe Acrobat and Reader heap overflow in PDF parsingcriticalCVSS 9.3Exploited since Published Adobe Acrobat, Adobe Reader
- CVE-2010-0806: Microsoft Internet Explorer use-after-free in Peer ObjectscriticalCVSS 9.3Exploited since Published Microsoft Internet Explorer
- CVE-2008-4250: Microsoft Windows buffer overflow in Server servicecriticalCVSS 10Exploited since Published Adobe Acrobat, Microsoft Defender, Microsoft DirectX
Technologies hit most
- 1.Microsoft Defender3 vulnerabilities
- 2.Adobe Acrobat2 vulnerabilities
- 3.Adobe Reader2 vulnerabilities
- 4.Microsoft DirectX2 vulnerabilities
- 5.Microsoft Internet Explorer2 vulnerabilities
- 6.Trend Micro Apex One2 vulnerabilities
- 7.Drupal1 vulnerability
- 8.Drupal Ajenti Core1 vulnerability
- 9.Drupal Core1 vulnerability
- 10.drupal/core (Packagist)1 vulnerability
- 11.Langflow1 vulnerability
- 12.langflow (PyPI)1 vulnerability
- 13.Microsoft Windows1 vulnerability
- 14.Microsoft Windows 20001 vulnerability
- 15.Microsoft Windows Server 20031 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-05-18.json, and this page as text at https://junglewise.ai/threats/exploited/2026-05-18.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 18 to 24 May 2026 (week 21)", https://junglewise.ai/threats/exploited/2026-05-18, 2 October 2026.