# Most vulnerable technologies, 7 to 13 November 2026

Source: https://junglewise.ai/threats/technologies  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies.json  
License: CC BY 4.0 with a link back

In the 7 days from 7 November 2026 to 13 November 2026, Junglewise Threat Intelligence recorded 4,518 new vulnerabilities: 223 critical, 1,770 high and 3 exploited in the wild. The most vulnerable technology was Microsoft Windows, with 422 vulnerabilities (8 critical), followed by IBM API Connect (205) and Microsoft Office Word (58).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Microsoft Windows](https://junglewise.ai/threats/technologies/windows) (Microsoft) | 422 | 8 | 313 | 0 | 9.8 |
| 2 | [IBM API Connect](https://junglewise.ai/threats/technologies/api-connect) (IBM) | 205 | 47 | 94 | 0 | 9.9 |
| 3 | [Microsoft Office Word](https://junglewise.ai/threats/technologies/office-word) (Microsoft) | 58 | 0 | 52 | 0 | 8.8 |
| 4 | [FFmpeg](https://junglewise.ai/threats/technologies/ffmpeg) (Ffmpeg) | 92 | 0 | 34 | 0 | 7.8 |
| 5 | [Microsoft Office Excel](https://junglewise.ai/threats/technologies/office-excel) (Microsoft) | 59 | 0 | 49 | 0 | 8.8 |
| 6 | [Microsoft SQL Server](https://junglewise.ai/threats/technologies/sql-server) (Microsoft) | 53 | 1 | 43 | 0 | 9.8 |
| 7 | [Fortinet FortiManager](https://junglewise.ai/threats/technologies/fortimanager) (Fortinet) | 41 | 4 | 37 | 0 | 9.8 |
| 8 | [PostgreSQL](https://junglewise.ai/threats/technologies/postgresql) (PostgreSQL) | 50 | 0 | 38 | 0 | 8.8 |
| 9 | [Adobe Connect](https://junglewise.ai/threats/technologies/adobe-connect) (Adobe) | 24 | 17 | 5 | 0 | 10 |
| 10 | [Fortinet FortiManager Cloud](https://junglewise.ai/threats/technologies/fortimanager-cloud) (Fortinet) | 37 | 2 | 35 | 0 | 9.8 |
| 11 | [Fortinet FortiAnalyzer](https://junglewise.ai/threats/technologies/fortianalyzer) (Fortinet) | 36 | 3 | 33 | 0 | 9.8 |
| 12 | [OpenEMR](https://junglewise.ai/threats/technologies/openemr-openemr) (OpenEMR) | 42 | 4 | 23 | 0 | 9.9 |
| 13 | [Fortinet Fortianalyzer Cloud](https://junglewise.ai/threats/technologies/fortianalyzer-cloud) (Fortinet) | 34 | 2 | 32 | 0 | 9.8 |
| 14 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 92 | 1 | 0 | 1 | n/a |
| 15 | [Fortinet FortiMail](https://junglewise.ai/threats/technologies/fortimail) (Fortinet) | 27 | 8 | 19 | 0 | 9.8 |
| 16 | [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox) (Mozilla) | 98 | 0 | 0 | 0 | n/a |
| 17 | [Microsoft Windows Installer](https://junglewise.ai/threats/technologies/windows-installer) (Microsoft) | 34 | 0 | 29 | 0 | 7.8 |
| 18 | [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr) (Mozilla) | 78 | 0 | 0 | 0 | n/a |
| 19 | [Microsoft Office SharePoint](https://junglewise.ai/threats/technologies/office-sharepoint) (Microsoft) | 26 | 3 | 17 | 0 | 9.9 |
| 20 | [Google Pixel](https://junglewise.ai/threats/technologies/google-pixel) (Google) | 70 | 0 | 0 | 0 | n/a |
| 21 | [Microsoft Office Outlook](https://junglewise.ai/threats/technologies/office-outlook) (Microsoft) | 17 | 1 | 15 | 1 | 8.8 |
| 22 | [Arista EOS](https://junglewise.ai/threats/technologies/eos) (Arista) | 24 | 2 | 13 | 0 | 9.8 |
| 23 | [Microsoft Windows Advanced Rasterization Platform](https://junglewise.ai/threats/technologies/windows-advanced-rasterization-platform) (Microsoft) | 20 | 0 | 20 | 0 | 8.8 |
| 24 | [Fortinet FortiAuthenticator](https://junglewise.ai/threats/technologies/fortiauthenticator) (Fortinet) | 18 | 2 | 15 | 0 | 9.1 |
| 25 | [Microsoft Visual-Studio-Code](https://junglewise.ai/threats/technologies/visual-studio-code) (Microsoft) | 18 | 1 | 16 | 0 | 9.6 |

## Most affected vendors

1. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 1,087 vulnerabilities, 26 critical, 1 exploited
2. [IBM](https://junglewise.ai/threats/vendors/ibm): 285 vulnerabilities, 54 critical, 1 exploited
3. [Fortinet](https://junglewise.ai/threats/vendors/fortinet): 97 vulnerabilities, 18 critical, 0 exploited
4. [Adobe](https://junglewise.ai/threats/vendors/adobe): 107 vulnerabilities, 21 critical, 0 exploited
5. [Google](https://junglewise.ai/threats/vendors/google): 251 vulnerabilities, 1 critical, 1 exploited
6. [Ffmpeg](https://junglewise.ai/threats/vendors/ffmpeg): 92 vulnerabilities, 0 critical, 0 exploited
7. [PostgreSQL](https://junglewise.ai/threats/vendors/postgresql): 49 vulnerabilities, 0 critical, 0 exploited
8. [SAP](https://junglewise.ai/threats/vendors/sap): 40 vulnerabilities, 9 critical, 0 exploited
9. [Mozilla](https://junglewise.ai/threats/vendors/mozilla): 108 vulnerabilities, 0 critical, 0 exploited
10. [OpenEMR](https://junglewise.ai/threats/vendors/openemr): 42 vulnerabilities, 4 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-123218: IBM Aspera Faspex authorization bypass](https://junglewise.ai/threats/cve-2026-123218-ibm-aspera-faspex-5-0-0-through-5-0-19-could-allow-an-authorized) (critical, exploited in the wild, CVSS 9.8, published 7 Nov 2026)
- [CVE-2026-124194: Microsoft Office Outlook user warning spoofing vulnerability](https://junglewise.ai/threats/cve-2026-124194-microsoft-office-outlook-missing-user-interaction-for) (critical, exploited in the wild, CVSS 6.5, published 10 Nov 2026)
- [CVE-2026-125350: Google Chrome use after free in XML](https://junglewise.ai/threats/cve-2026-125350-use-after-free-in-xml-in-google-chrome-prior-to-157-0-8103-50) (critical, exploited in the wild, published 10 Nov 2026)
- [CVE-2026-127277: Linksys EA8100 SMB service improper initialization](https://junglewise.ai/threats/cve-2026-127277-a-security-flaw-has-been-discovered-in-linksys-ea8100-1-0-3) (critical, CVSS 10, published 13 Nov 2026)
- [CVE-2026-127275: Linksys EA8100 authentication bypass in JNAP API](https://junglewise.ai/threats/cve-2026-127275-a-vulnerability-was-determined-in-linksys-ea8100-1-0-3-216940) (critical, CVSS 10, published 13 Nov 2026)
- [CVE-2026-78287: STAGGS WordPress plugin code injection in file upload](https://junglewise.ai/threats/cve-2026-78287-improper-control-of-generation-of-code-code-injection) (critical, CVSS 10, published 11 Nov 2026)
- [CVE-2026-121889: Adobe Connect server-side request forgery privilege escalation](https://junglewise.ai/threats/cve-2026-121889-adobe-connect-is-affected-by-a-server-side-request-forgery-ssrf) (critical, CVSS 10, published 10 Nov 2026)
- [CVE-2026-121356: Adobe Connect multiple critical vulnerabilities](https://junglewise.ai/threats/cve-2026-121356-adobe-connect-is-affected-by-a-server-side-request-forgery-ssrf) (critical, CVSS 10, published 10 Nov 2026)
- [CVE-2026-121353: Adobe Connect CRLF injection](https://junglewise.ai/threats/cve-2026-121353-adobe-connect-is-affected-by-an-improper-neutralization-of-crlf) (critical, CVSS 10, published 10 Nov 2026)
- [CVE-2026-121352: Adobe Connect incorrect authorization privilege escalation](https://junglewise.ai/threats/cve-2026-121352-adobe-connect-is-affected-by-an-incorrect-authorization) (critical, CVSS 10, published 10 Nov 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies, 7 to 13 November 2026", https://junglewise.ai/threats/technologies, 13 November 2026.