# Most vulnerable technologies in August 2026

Source: https://junglewise.ai/threats/monthly/2026-08  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 09:11 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/monthly/2026-08.json  
License: CC BY 4.0 with a link back

In August 2026, Junglewise Threat Intelligence recorded 8,028 new vulnerabilities: 1,015 critical, 2,982 high and 24 exploited in the wild. The most vulnerable technology was Linux Kernel, with 972 vulnerabilities (147 critical, 1 exploited in the wild), followed by Google Chrome (334) and IBM AIX (73).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 972 | 147 | 454 | 1 | 10 |
| 2 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 334 | 44 | 84 | 0 | 9.8 |
| 3 | [IBM AIX](https://junglewise.ai/threats/technologies/aix) (IBM) | 73 | 12 | 43 | 0 | 9.9 |
| 4 | [IBM PowerVM VIOS](https://junglewise.ai/threats/technologies/powervm-vios) (IBM) | 73 | 12 | 43 | 0 | 9.9 |
| 5 | [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird) (Mozilla) | 52 | 15 | 25 | 0 | 10 |
| 6 | [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox) (Mozilla) | 52 | 14 | 25 | 0 | 10 |
| 7 | [Microsoft Windows ](https://junglewise.ai/threats/technologies/windows-) (Microsoft) | 58 | 7 | 38 | 0 | 10 |
| 8 | [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr) (Mozilla) | 49 | 12 | 25 | 0 | 10 |
| 9 | [SiYuan](https://junglewise.ai/threats/technologies/siyuan) (SiYuan) | 58 | 10 | 20 | 0 | 10 |
| 10 | [Pip Nltk](https://junglewise.ai/threats/technologies/nltk) (Pip) | 57 | 6 | 29 | 0 | 9.8 |
| 11 | [Npm Flowise](https://junglewise.ai/threats/technologies/flowise) (Npm) | 35 | 11 | 17 | 0 | 10 |
| 12 | [Oracle Helidon](https://junglewise.ai/threats/technologies/helidon) (Oracle) | 55 | 6 | 19 | 0 | 9.8 |
| 13 | [Oracle Hyperion Data Relationship Management](https://junglewise.ai/threats/technologies/hyperion-data-relationship-management) (Oracle) | 35 | 7 | 26 | 0 | 10 |
| 14 | [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe) (Apple) | 49 | 8 | 9 | 1 | 9.8 |
| 15 | [Oracle Commerce Experience Manager](https://junglewise.ai/threats/technologies/commerce-experience-manager) (Oracle) | 40 | 7 | 21 | 0 | 9.3 |
| 16 | [Oracle Commerce Guided Search](https://junglewise.ai/threats/technologies/commerce-guided-search) (Oracle) | 40 | 7 | 21 | 0 | 9.3 |
| 17 | [NLTK Project Natural Language Toolkit](https://junglewise.ai/threats/technologies/natural-language-toolkit) (NLTK Project) | 45 | 5 | 21 | 0 | 9.8 |
| 18 | [Gitpython Project Gitpython](https://junglewise.ai/threats/technologies/gitpython) (Gitpython Project) | 40 | 3 | 26 | 0 | 9.8 |
| 19 | [Oracle Hyperion Financial Management](https://junglewise.ai/threats/technologies/hyperion-financial-management) (Oracle) | 49 | 3 | 18 | 0 | 10 |
| 20 | [D-Link DWR-M961](https://junglewise.ai/threats/technologies/dwr-m961) (D-Link) | 15 | 15 | 0 | 0 | 9.8 |
| 21 | [DrayTek VigorSwitch FX2120](https://junglewise.ai/threats/technologies/vigorswitch-fx2120) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 22 | [DrayTek VigorSwitch G1280](https://junglewise.ai/threats/technologies/vigorswitch-g1280) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 23 | [DrayTek VigorSwitch G1282](https://junglewise.ai/threats/technologies/vigorswitch-g1282) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 24 | [DrayTek VigorSwitch G2100](https://junglewise.ai/threats/technologies/vigorswitch-g2100) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 25 | [DrayTek VigorSwitch G2121](https://junglewise.ai/threats/technologies/vigorswitch-g2121) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |

## Most affected vendors

1. [Linux](https://junglewise.ai/threats/vendors/linux): 972 vulnerabilities, 147 critical, 1 exploited
2. [Oracle](https://junglewise.ai/threats/vendors/oracle): 295 vulnerabilities, 31 critical, 0 exploited
3. [Google](https://junglewise.ai/threats/vendors/google): 352 vulnerabilities, 46 critical, 0 exploited
4. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 246 vulnerabilities, 24 critical, 3 exploited
5. [IBM](https://junglewise.ai/threats/vendors/ibm): 175 vulnerabilities, 24 critical, 0 exploited
6. [Npm](https://junglewise.ai/threats/vendors/npm): 191 vulnerabilities, 35 critical, 0 exploited
7. [Pip](https://junglewise.ai/threats/vendors/pypi): 190 vulnerabilities, 15 critical, 1 exploited
8. [Go](https://junglewise.ai/threats/vendors/go): 143 vulnerabilities, 22 critical, 1 exploited
9. [Apache](https://junglewise.ai/threats/vendors/apache): 83 vulnerabilities, 20 critical, 0 exploited
10. [Composer](https://junglewise.ai/threats/vendors/packagist): 101 vulnerabilities, 5 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-72898: Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and…](https://junglewise.ai/threats/cve-2026-72898-metabase-sql-injection-in-password-reset-endpoint) (critical, exploited in the wild, CVSS 10, published 10 Aug 2026)
- [CVE-2026-5430: The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported…](https://junglewise.ai/threats/cve-2026-5430-wso2-api-control-plane-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 10, published 6 Aug 2026)
- [CVE-2021-23758: Ajax.NET Professional unsafe deserialization of untrusted data](https://junglewise.ai/threats/cve-2021-23758-ajax-net-professional-unsafe-deserialization-of-untrusted-data) (critical, exploited in the wild, CVSS 9.8, published 26 Aug 2026)
- [CVE-2026-60004: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.](https://junglewise.ai/threats/cve-2026-60004-gitea-code-injection-in-diffpatch-api) (critical, exploited in the wild, CVSS 9.8, published 26 Aug 2026)
- [CVE-2026-82329: JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated…](https://junglewise.ai/threats/cve-2026-82329-jfrog-artifactory-improper-authentication-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 28 Aug 2026)
- [CVE-2026-73570: Zimbra Collaboration Suite OS command injection in SMTP](https://junglewise.ai/threats/cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp) (critical, exploited in the wild, CVSS 9.8, published 21 Aug 2026)
- [CVE-2026-81578: An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under…](https://junglewise.ai/threats/cve-2026-81578-papercut-ng-mf-missing-authentication-for-critical-function) (critical, exploited in the wild, CVSS 9.8, published 28 Aug 2026)
- [CVE-2026-72529: A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X…](https://junglewise.ai/threats/cve-2026-72529-trueconf-server-missing-authentication-for-critical-function) (critical, exploited in the wild, CVSS 9.8, published 19 Aug 2026)
- [CVE-2026-65400: An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS…](https://junglewise.ai/threats/cve-2026-65400-apple-macos-screen-sharing-authentication-bypass) (critical, exploited in the wild, CVSS 9.8, published 6 Aug 2026)
- [CVE-2026-64849: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to…](https://junglewise.ai/threats/cve-2026-64849-mlflow-server-side-request-forgery) (critical, exploited in the wild, CVSS 9.3, published 17 Aug 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies in August 2026", https://junglewise.ai/threats/monthly/2026-08, 26 September 2026.