# Most vulnerable technologies in May 2026

Source: https://junglewise.ai/threats/monthly/2026-05  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 09:24 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/monthly/2026-05.json  
License: CC BY 4.0 with a link back

In May 2026, Junglewise Threat Intelligence recorded 6,351 new vulnerabilities: 517 critical, 2,075 high and 26 exploited in the wild. The most vulnerable technology was Linux Kernel, with 913 vulnerabilities (28 critical), followed by Google Chrome (249) and Apple macOS (111).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 913 | 28 | 177 | 0 | 9.8 |
| 2 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 249 | 3 | 53 | 0 | 9.8 |
| 3 | [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe) (Apple) | 111 | 1 | 65 | 0 | 9.6 |
| 4 | [Microsoft Windows](https://junglewise.ai/threats/technologies/windows-) (Microsoft) | 51 | 3 | 42 | 1 | 10 |
| 5 | [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados) (Apple) | 70 | 0 | 42 | 0 | 8.8 |
| 6 | [TOTOLINK A8000RU](https://junglewise.ai/threats/technologies/a8000ru) (TOTOLINK) | 24 | 24 | 0 | 0 | 9.8 |
| 7 | [Openclaw](https://junglewise.ai/threats/technologies/openclaw) (Openclaw) | 81 | 2 | 24 | 0 | 9.8 |
| 8 | [Pip Open-Webui](https://junglewise.ai/threats/technologies/open-webui) (Pip) | 61 | 1 | 31 | 0 | 9.1 |
| 9 | [Apple visionOS](https://junglewise.ai/threats/technologies/visionos) (Apple) | 48 | 0 | 26 | 0 | 8.8 |
| 10 | [Apple tvOS](https://junglewise.ai/threats/technologies/tvos) (Apple) | 46 | 0 | 27 | 0 | 8.8 |
| 11 | [Apple watchOS](https://junglewise.ai/threats/technologies/watchos) (Apple) | 43 | 0 | 25 | 0 | 8.8 |
| 12 | [Npm Vm2](https://junglewise.ai/threats/technologies/vm2) (Npm) | 21 | 13 | 3 | 0 | 10 |
| 13 | [HPE Aruba Networking AOS-10](https://junglewise.ai/threats/technologies/aos-10) (HPE Aruba Networking) | 27 | 0 | 27 | 0 | 8.8 |
| 14 | [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq) (Thorsten) | 28 | 4 | 13 | 0 | 9.8 |
| 15 | [Open ISES Tickets](https://junglewise.ai/threats/technologies/tickets) (Open ISES) | 47 | 0 | 12 | 0 | 8.2 |
| 16 | [HPE Aruba Networking AOS-8](https://junglewise.ai/threats/technologies/aos-8) (HPE Aruba Networking) | 23 | 0 | 23 | 0 | 7.5 |
| 17 | [MB connect line mbCONNECT24](https://junglewise.ai/threats/technologies/mbconnect24) (MB connect line) | 40 | 0 | 14 | 0 | 7.5 |
| 18 | [MB connect line mymbCONNECT24](https://junglewise.ai/threats/technologies/mymbconnect24) (MB connect line) | 40 | 0 | 14 | 0 | 7.5 |
| 19 | [F5 BIG-IP](https://junglewise.ai/threats/technologies/big-ip) (F5) | 32 | 0 | 18 | 0 | 8.8 |
| 20 | [F5 BIG-IP Access Policy Manager](https://junglewise.ai/threats/technologies/big-ip-access-policy-manager) (F5) | 28 | 1 | 17 | 0 | 9.1 |
| 21 | [Red Hat Self-service automation portal](https://junglewise.ai/threats/technologies/self-service-automation-portal) (Red Hat) | 12 | 10 | 2 | 0 | 10 |
| 22 | [Concrete CMS](https://junglewise.ai/threats/technologies/concrete-cms) (Concrete CMS) | 44 | 0 | 10 | 0 | 8.9 |
| 23 | [Composer Concrete5/Concrete5](https://junglewise.ai/threats/technologies/concrete5-concrete5) (Composer) | 44 | 0 | 10 | 0 | 8.9 |
| 24 | [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox) (Mozilla) | 39 | 3 | 5 | 0 | 9.8 |
| 25 | [Netatalk](https://junglewise.ai/threats/technologies/netatalk) (Netatalk) | 33 | 1 | 13 | 0 | 9.9 |

## Most affected vendors

1. [Linux](https://junglewise.ai/threats/vendors/linux): 914 vulnerabilities, 28 critical, 0 exploited
2. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 174 vulnerabilities, 27 critical, 7 exploited
3. [Go](https://junglewise.ai/threats/vendors/go): 212 vulnerabilities, 42 critical, 0 exploited
4. [Npm](https://junglewise.ai/threats/vendors/npm): 215 vulnerabilities, 32 critical, 0 exploited
5. [Pip](https://junglewise.ai/threats/vendors/pypi): 191 vulnerabilities, 17 critical, 0 exploited
6. [Google](https://junglewise.ai/threats/vendors/google): 263 vulnerabilities, 4 critical, 0 exploited
7. [Composer](https://junglewise.ai/threats/vendors/packagist): 177 vulnerabilities, 13 critical, 0 exploited
8. [Apple](https://junglewise.ai/threats/vendors/apple): 123 vulnerabilities, 1 critical, 0 exploited
9. [Red Hat](https://junglewise.ai/threats/vendors/red-hat): 76 vulnerabilities, 18 critical, 0 exploited
10. [Maven](https://junglewise.ai/threats/vendors/maven): 75 vulnerabilities, 11 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2008-4250: Microsoft Windows buffer overflow in Server service](https://junglewise.ai/threats/cve-2008-4250-microsoft-windows-buffer-overflow-in-server-service) (critical, exploited in the wild, CVSS 10, published 20 May 2026)
- [CVE-2026-20182: Cisco Catalyst SD-WAN authentication bypass in peering mechanism](https://junglewise.ai/threats/cve-2026-20182-cisco-catalyst-sd-wan-authentication-bypass-in-peering-mechanism) (critical, exploited in the wild, CVSS 10, published 14 May 2026)
- [CVE-2026-34910: Ubiquiti UniFi OS command injection via improper input validation](https://junglewise.ai/threats/cve-2026-34910-ubiquiti-unifi-os-command-injection-via-improper-input-validation) (critical, exploited in the wild, CVSS 10, published 22 May 2026)
- [CVE-2026-34909: Ubiquiti UniFi OS path traversal in underlying system files](https://junglewise.ai/threats/cve-2026-34909-ubiquiti-unifi-os-path-traversal-in-underlying-system-files) (critical, exploited in the wild, CVSS 10, published 22 May 2026)
- [CVE-2026-34908: Ubiquiti UniFi OS improper access control](https://junglewise.ai/threats/cve-2026-34908-ubiquiti-unifi-os-improper-access-control) (critical, exploited in the wild, CVSS 10, published 22 May 2026)
- [CVE-2026-48172: LiteSpeed User-End cPanel Plugin privilege escalation to root](https://junglewise.ai/threats/cve-2026-48172-litespeed-user-end-cpanel-plugin-privilege-escalation-to-root) (critical, exploited in the wild, CVSS 10, published 21 May 2026)
- [CVE-2026-42208: BerriAI LiteLLM SQL injection in Proxy API key verification](https://junglewise.ai/threats/cve-2026-42208-berriai-litellm-sql-injection-in-proxy-api-key-verification) (critical, exploited in the wild, CVSS 9.8, published 8 May 2026)
- [CVE-2026-9082: Drupal Drupal core SQL injection in database abstraction API](https://junglewise.ai/threats/cve-2026-9082-drupal-drupal-core-sql-injection-in-database-abstraction-api) (critical, exploited in the wild, CVSS 9.8, published 20 May 2026)
- [CVE-2026-0300: Palo Alto Networks PAN-OS buffer overflow in User-ID Authentication Portal](https://junglewise.ai/threats/cve-2026-0300-palo-alto-networks-pan-os-buffer-overflow-in-user-id) (critical, exploited in the wild, CVSS 9.8, published 6 May 2026)
- [CVE-2026-46817: Oracle E-Business Suite remote compromise in Oracle Payments](https://junglewise.ai/threats/cve-2026-46817-oracle-e-business-suite-remote-compromise-in-oracle-payments) (critical, exploited in the wild, CVSS 9.8, published 28 May 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies in May 2026", https://junglewise.ai/threats/monthly/2026-05, 26 September 2026.