# Most vulnerable technologies in March 2026

Source: https://junglewise.ai/threats/monthly/2026-03  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 10:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/monthly/2026-03.json  
License: CC BY 4.0 with a link back

In March 2026, Junglewise Threat Intelligence recorded 1,652 new vulnerabilities: 147 critical, 442 high and 25 exploited in the wild. The most vulnerable technology was Openclaw, with 302 vulnerabilities (5 critical), followed by Linux Kernel (117) and Apple macOS (30).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Openclaw](https://junglewise.ai/threats/technologies/openclaw) (Openclaw) | 302 | 5 | 19 | 0 | 9.9 |
| 2 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 117 | 4 | 40 | 0 | 9.8 |
| 3 | [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe) (Apple) | 30 | 5 | 13 | 3 | 9.8 |
| 4 | [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird) (Mozilla) | 21 | 10 | 11 | 0 | 10 |
| 5 | [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox) (Mozilla) | 20 | 10 | 10 | 0 | 10 |
| 6 | [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr) (Mozilla) | 19 | 9 | 10 | 0 | 10 |
| 7 | [Apple Multiple Products](https://junglewise.ai/threats/technologies/multiple-products) (Apple) | 5 | 5 | 0 | 5 | 9.8 |
| 8 | [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados) (Apple) | 16 | 4 | 1 | 4 | 8.8 |
| 9 | [Apple watchOS](https://junglewise.ai/threats/technologies/watchos) (Apple) | 10 | 4 | 0 | 4 | 8.8 |
| 10 | [Microsoft Windows](https://junglewise.ai/threats/technologies/windows-) (Microsoft) | 17 | 2 | 15 | 0 | 9.8 |
| 11 | [Apple tvOS](https://junglewise.ai/threats/technologies/tvos) (Apple) | 8 | 3 | 0 | 3 | 8.8 |
| 12 | [Google Android](https://junglewise.ai/threats/technologies/android) (Google) | 11 | 3 | 7 | 1 | 9.8 |
| 13 | [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp) (Siemens) | 24 | 0 | 11 | 0 | 7.8 |
| 14 | [Apple visionOS](https://junglewise.ai/threats/technologies/visionos) (Apple) | 13 | 2 | 0 | 2 | 7.8 |
| 15 | [Langflow](https://junglewise.ai/threats/technologies/langflow) (Langflow) | 8 | 3 | 5 | 1 | 9.9 |
| 16 | [Mozilla Thunderbird-Esr](https://junglewise.ai/threats/technologies/thunderbird-esr) (Mozilla) | 8 | 5 | 3 | 0 | 10 |
| 17 | [Cisco Secure Firewall Management Center](https://junglewise.ai/threats/technologies/secure-firewall-management-center) (Cisco) | 5 | 2 | 1 | 2 | 10 |
| 18 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 3 | 2 | 1 | 2 | 8.8 |
| 19 | [Cisco Secure Firewall Management Center (FMC)](https://junglewise.ai/threats/technologies/secure-firewall-management-center-fmc) (Cisco) | 3 | 2 | 0 | 2 | 10 |
| 20 | Cisco Security Cloud Control (Cisco) | 2 | 2 | 0 | 2 | 10 |
| 21 | [Lantronix EDS5008](https://junglewise.ai/threats/technologies/eds5008) (Lantronix) | 5 | 2 | 3 | 1 | 9.8 |
| 22 | [Lantronix Eds5008 Firmware](https://junglewise.ai/threats/technologies/eds5008-firmware) (Lantronix) | 5 | 2 | 3 | 1 | 9.8 |
| 23 | [Lantronix EDS5016](https://junglewise.ai/threats/technologies/eds5016) (Lantronix) | 5 | 2 | 3 | 1 | 9.8 |
| 24 | [Lantronix Eds5016 Firmware](https://junglewise.ai/threats/technologies/eds5016-firmware) (Lantronix) | 5 | 2 | 3 | 1 | 9.8 |
| 25 | [Lantronix EDS5032](https://junglewise.ai/threats/technologies/eds5032) (Lantronix) | 5 | 2 | 3 | 1 | 9.8 |

## Most affected vendors

1. [Openclaw](https://junglewise.ai/threats/vendors/openclaw): 302 vulnerabilities, 5 critical, 0 exploited
2. [Npm](https://junglewise.ai/threats/vendors/npm): 185 vulnerabilities, 7 critical, 0 exploited
3. [Red Hat](https://junglewise.ai/threats/vendors/red-hat): 84 vulnerabilities, 9 critical, 0 exploited
4. [Linux](https://junglewise.ai/threats/vendors/linux): 117 vulnerabilities, 4 critical, 0 exploited
5. [Apple](https://junglewise.ai/threats/vendors/apple): 34 vulnerabilities, 8 critical, 6 exploited
6. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 31 vulnerabilities, 4 critical, 2 exploited
7. [Cisco](https://junglewise.ai/threats/vendors/cisco): 48 vulnerabilities, 3 critical, 3 exploited
8. [Mozilla](https://junglewise.ai/threats/vendors/mozilla): 21 vulnerabilities, 10 critical, 0 exploited
9. [Pip](https://junglewise.ai/threats/vendors/pypi): 36 vulnerabilities, 2 critical, 0 exploited
10. [Adobe](https://junglewise.ai/threats/vendors/adobe): 44 vulnerabilities, 0 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2025-32432: Craft CMS remote code execution via code injection](https://junglewise.ai/threats/cve-2025-32432-craft-cms-remote-code-execution-via-code-injection) (critical, exploited in the wild, CVSS 10, published 20 Mar 2026)
- [CVE-2026-20079: Cisco Secure Firewall Management Center auth bypass in web interface](https://junglewise.ai/threats/cve-2026-20079-cisco-secure-firewall-management-center-auth-bypass-in-web) (critical, exploited in the wild, CVSS 10, published 4 Mar 2026)
- [CVE-2026-20131: Cisco Secure Firewall Management Center deserialization RCE](https://junglewise.ai/threats/cve-2026-20131-cisco-secure-firewall-management-center-deserialization-rce) (critical, exploited in the wild, CVSS 10, published 19 Mar 2026)
- [CVE-2017-7921: Hikvision IP Cameras improper authentication](https://junglewise.ai/threats/cve-2017-7921-hikvision-ip-cameras-improper-authentication) (critical, exploited in the wild, CVSS 9.8, published 5 Mar 2026)
- [CVE-2026-3055: Citrix NetScaler out-of-bounds read in SAML IdP](https://junglewise.ai/threats/cve-2026-3055-citrix-netscaler-out-of-bounds-read-in-saml-idp) (critical, exploited in the wild, CVSS 9.8, published 30 Mar 2026)
- [CVE-2025-54068: Laravel Livewire code injection in component hydration](https://junglewise.ai/threats/cve-2025-54068-laravel-livewire-code-injection-in-component-hydration) (critical, exploited in the wild, CVSS 9.8, published 20 Mar 2026)
- [CVE-2025-26399: SolarWinds Web Help Desk deserialization RCE in AjaxProxy](https://junglewise.ai/threats/cve-2025-26399-solarwinds-web-help-desk-deserialization-rce-in-ajaxproxy) (critical, exploited in the wild, CVSS 9.8, published 9 Mar 2026)
- [CVE-2026-33017: Langflow unauthenticated remote code execution in build_public_tmp endpoint](https://junglewise.ai/threats/cve-2026-33017-langflow-unauthenticated-remote-code-execution-in-build-public) (critical, exploited in the wild, CVSS 9.8, published 20 Mar 2026)
- [CVE-2021-22681: Rockwell Automation Logix Designer authentication bypass in Logix Controllers](https://junglewise.ai/threats/cve-2021-22681-rockwell-automation-logix-designer-authentication-bypass-in-logix) (critical, exploited in the wild, CVSS 9.8, published 5 Mar 2026)
- [CVE-2025-53521: F5 BIG-IP stack-based buffer overflow in APM](https://junglewise.ai/threats/cve-2025-53521-f5-big-ip-stack-based-buffer-overflow-in-apm) (critical, exploited in the wild, CVSS 9.8, published 27 Mar 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies in March 2026", https://junglewise.ai/threats/monthly/2026-03, 26 September 2026.