Monthly report
Most vulnerable technologies in October 2026
Final report, published . It does not change.
In October 2026, Junglewise Threat Intelligence recorded 16,643 new vulnerabilities: 1,051 critical, 4,731 high and 24 exploited in the wild. The most vulnerable technology was Microsoft Windows, with 677 vulnerabilities (21 critical, 1 exploited in the wild), followed by Linux Kernel (1,041) and Google Chrome (732).
- New vulnerabilities
- 16,643
- Critical
- 1,051
- Exploited in the wild
- 24
- Technologies affected
- 7,346
Ranking
Most affected vendors
- 1.Microsoft1,323 vulnerabilities, 62 critical, 1 exploited
- 2.Oracle988 vulnerabilities, 66 critical, 0 exploited
- 3.Linux971 vulnerabilities, 0 critical, 0 exploited
- 4.Google792 vulnerabilities, 13 critical, 2 exploited
- 5.IBM240 vulnerabilities, 29 critical, 0 exploited
- 6.Adobe171 vulnerabilities, 31 critical, 0 exploited
- 7.Apache334 vulnerabilities, 15 critical, 0 exploited
- 8.Apple392 vulnerabilities, 0 critical, 0 exploited
- 9.Mozilla270 vulnerabilities, 4 critical, 0 exploited
- 10.Dell110 vulnerabilities, 14 critical, 0 exploited
Most severe vulnerabilities
- CVE-2026-97229: GitLab CE/EE integer overflow in CI/CD regular expression compilercriticalexploited in the wildCVSS 10EPSS 18.4%
- CVE-2026-105134: Ahsay AhsayCBS OS command injection in UpdateReceiverscriticalexploited in the wildCVSS 10EPSS 1.8%
- CVE-2026-114625: Arista VeloCloud Orchestrator privilege escalationcriticalexploited in the wildCVSS 9.9EPSS 0.6%
- CVE-2026-104286: Fortinet FortiMail path traversal vulnerabilitycriticalexploited in the wildCVSS 9.8EPSS 2.2%
- CVE-2026-102764: BeyondTrust Remote Support authentication bypass by spoofingcriticalexploited in the wildCVSS 9.8EPSS 0.6%
- CVE-2026-96951: Microsoft Windows command injection in Shellcriticalexploited in the wildCVSS 8.8EPSS 1.5%
- CVE-2026-104935: Ivanti Connect Secure authentication bypass by spoofingcriticalexploited in the wildCVSS 8.6EPSS 26.0%
- CVE-2026-76418: Cisco Secure Firewall ASA and FTD SSL VPN denial of servicecriticalexploited in the wildCVSS 8.6EPSS 0.6%
- CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS command injectioncriticalexploited in the wildCVSS 7.8EPSS 0.7%
- CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerabilitycriticalexploited in the wildCVSS 7.5EPSS 0.5%
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
Technologies are ranked by a score: 10 points for each vulnerability exploited in the wild, 5 for each critical, 2 for each high and 1 for every vulnerability. A vulnerability counts once for every technology it affects, so one advisory can appear under several products.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/monthly/2026-10.json, and this page as text at https://junglewise.ai/threats/monthly/2026-10.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies in October 2026", https://junglewise.ai/threats/monthly/2026-10, 2 November 2026.