# Most vulnerable technologies in April 2026

Source: https://junglewise.ai/threats/monthly/2026-04  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 10:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/monthly/2026-04.json  
License: CC BY 4.0 with a link back

In April 2026, Junglewise Threat Intelligence recorded 3,561 new vulnerabilities: 379 critical, 1,331 high and 35 exploited in the wild. The most vulnerable technology was Linux Kernel, with 300 vulnerabilities (20 critical, 2 exploited in the wild), followed by Openclaw (260) and Microsoft Windows (108).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 300 | 20 | 147 | 2 | 9.8 |
| 2 | [Openclaw](https://junglewise.ai/threats/technologies/openclaw) (Openclaw) | 260 | 4 | 32 | 0 | 9.6 |
| 3 | [Microsoft Windows](https://junglewise.ai/threats/technologies/windows-) (Microsoft) | 108 | 8 | 62 | 5 | 9.8 |
| 4 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 123 | 7 | 76 | 1 | 9.8 |
| 5 | [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe) (Apple) | 102 | 4 | 61 | 1 | 9.8 |
| 6 | [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp) (Siemens) | 46 | 6 | 19 | 0 | 9.8 |
| 7 | [Dlink Di-8003](https://junglewise.ai/threats/technologies/di-8003) (Dlink) | 27 | 0 | 27 | 0 | 7.5 |
| 8 | [Dlink Di-8003 Firmware](https://junglewise.ai/threats/technologies/di-8003-firmware) (Dlink) | 27 | 0 | 27 | 0 | 7.5 |
| 9 | [Chamilo Lms](https://junglewise.ai/threats/technologies/chamilo-lms) (Chamilo) | 31 | 3 | 17 | 0 | 9.8 |
| 10 | [Npm Flowise](https://junglewise.ai/threats/technologies/flowise) (Npm) | 26 | 4 | 15 | 0 | 9.9 |
| 11 | [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox) (Mozilla) | 21 | 4 | 17 | 0 | 9.8 |
| 12 | [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird) (Mozilla) | 21 | 4 | 17 | 0 | 9.8 |
| 13 | [PraisonAI](https://junglewise.ai/threats/technologies/praisonai) (Praison) | 18 | 8 | 8 | 0 | 9.9 |
| 14 | [Microsoft Windows 11](https://junglewise.ai/threats/technologies/windows-11) (Microsoft) | 20 | 1 | 15 | 1 | 9.8 |
| 15 | [Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp) (Siemens) | 29 | 3 | 10 | 0 | 9.8 |
| 16 | [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr) (Mozilla) | 16 | 3 | 13 | 0 | 9.8 |
| 17 | [Amazon AWS](https://junglewise.ai/threats/technologies/aws) (Amazon) | 13 | 1 | 12 | 1 | 8.8 |
| 18 | [Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/siplus-s7-1500-cpu-1518-4-pn-dp-mfp) (Siemens) | 21 | 3 | 7 | 0 | 9.8 |
| 19 | [Cisco Catalyst SD-WAN Manager](https://junglewise.ai/threats/technologies/catalyst-sd-wan-manager) (Cisco) | 3 | 3 | 0 | 3 | 7.5 |
| 20 | [Composer Wwbn/Avideo](https://junglewise.ai/threats/technologies/wwbn-avideo) (Composer) | 18 | 3 | 7 | 0 | 10 |
| 21 | [MervinPraison PraisonAI Agents](https://junglewise.ai/threats/technologies/praisonai-agents) (MervinPraison) | 13 | 4 | 6 | 0 | 9.9 |
| 22 | [Endian-Firewall-Community](https://junglewise.ai/threats/technologies/firewall-community) (Endian) | 32 | 0 | 6 | 0 | 8.8 |
| 23 | [Tenda F451](https://junglewise.ai/threats/technologies/f451) (Tenda) | 14 | 0 | 14 | 0 | 8.8 |
| 24 | [Microsoft Windows 10](https://junglewise.ai/threats/technologies/windows-10) (Microsoft) | 11 | 1 | 8 | 1 | 9.8 |
| 25 | [Npm Flowise-Components](https://junglewise.ai/threats/technologies/flowise-components) (Npm) | 12 | 3 | 7 | 0 | 9.9 |

## Most affected vendors

1. [Linux](https://junglewise.ai/threats/vendors/linux): 300 vulnerabilities, 20 critical, 2 exploited
2. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 159 vulnerabilities, 21 critical, 11 exploited
3. [Npm](https://junglewise.ai/threats/vendors/npm): 215 vulnerabilities, 21 critical, 0 exploited
4. [Go](https://junglewise.ai/threats/vendors/go): 145 vulnerabilities, 16 critical, 0 exploited
5. [Openclaw](https://junglewise.ai/threats/vendors/openclaw): 260 vulnerabilities, 4 critical, 0 exploited
6. [Google](https://junglewise.ai/threats/vendors/google): 129 vulnerabilities, 7 critical, 1 exploited
7. [Pip](https://junglewise.ai/threats/vendors/pypi): 106 vulnerabilities, 16 critical, 0 exploited
8. [Apple](https://junglewise.ai/threats/vendors/apple): 104 vulnerabilities, 4 critical, 1 exploited
9. [Red Hat](https://junglewise.ai/threats/vendors/red-hat): 73 vulnerabilities, 11 critical, 0 exploited
10. [Composer](https://junglewise.ai/threats/vendors/packagist): 68 vulnerabilities, 8 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2025-32975: Quest KACE Systems Management Appliance authentication bypass in SSO](https://junglewise.ai/threats/cve-2025-32975-quest-kace-systems-management-appliance-authentication-bypass-in) (critical, exploited in the wild, CVSS 10, published 20 Apr 2026)
- [CVE-2024-57726: SimpleHelp privilege escalation via missing authorization in API key creation](https://junglewise.ai/threats/cve-2024-57726-simplehelp-privilege-escalation-via-missing-authorization-in-api) (critical, exploited in the wild, CVSS 9.9, published 24 Apr 2026)
- [CVE-2026-35616: Fortinet FortiClientEMS improper access control in API](https://junglewise.ai/threats/cve-2026-35616-fortinet-forticlientems-improper-access-control-in-api) (critical, exploited in the wild, CVSS 9.8, published 4 Apr 2026)
- [CVE-2024-7399: Samsung MagicINFO 9 Server path traversal](https://junglewise.ai/threats/cve-2024-7399-samsung-magicinfo-9-server-path-traversal) (critical, exploited in the wild, CVSS 9.8, published 24 Apr 2026)
- [CVE-2026-41940: WebPros cPanel & WHM authentication bypass in login flow](https://junglewise.ai/threats/cve-2026-41940-webpros-cpanel-whm-authentication-bypass-in-login-flow) (critical, exploited in the wild, CVSS 9.8, published 30 Apr 2026)
- [CVE-2026-1340: Ivanti Endpoint Manager Mobile code injection](https://junglewise.ai/threats/cve-2026-1340-ivanti-endpoint-manager-mobile-code-injection) (critical, exploited in the wild, CVSS 9.8, published 8 Apr 2026)
- [CVE-2026-21643: Fortinet FortiClient EMS SQL injection](https://junglewise.ai/threats/cve-2026-21643-fortinet-forticlient-ems-sql-injection) (critical, exploited in the wild, CVSS 9.8, published 13 Apr 2026)
- [CVE-2026-39808: Fortinet FortiSandbox OS command injection in API endpoint](https://junglewise.ai/threats/cve-2026-39808-fortinet-fortisandbox-os-command-injection-in-api-endpoint) (critical, exploited in the wild, CVSS 9.8, published 14 Apr 2026)
- [CVE-2026-39987: Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass](https://junglewise.ai/threats/cve-2026-39987-marimo-pre-auth-remote-code-execution-via-terminal-websocket) (critical, exploited in the wild, CVSS 9.8, published 8 Apr 2026)
- [CVE-2026-33824: Microsoft Windows double free in IKE Extension](https://junglewise.ai/threats/cve-2026-33824-microsoft-windows-double-free-in-ike-extension) (critical, exploited in the wild, CVSS 9.8, published 14 Apr 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies in April 2026", https://junglewise.ai/threats/monthly/2026-04, 26 September 2026.