# vulnerabilities Source: https://junglewise.ai/threats/technologies/x-unknown Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/x-unknown.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 29 vulnerabilities in : 7 in the last 7 days and 29 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-95784, was published on 10 November 2026. 17 vulnerabilities in the last four weeks, up 240% on the four before (5). 1 critical against 1. ## Counts - Last 7 days: 7 - Last 30 days: 21 - Last 90 days: 29 - All time: 29 (2 critical, 0 exploited in the wild) ## Latest vulnerabilities - [CVE-2026-95784: System component denial of service vulnerability](https://junglewise.ai/threats/cve-2026-95784-a-vulnerability-exists-in-a-system-component-that-may-under) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-97874: Hessian remoting authentication bypass with non-root context path](https://junglewise.ai/threats/cve-2026-97874-when-hessian-remoting-is-configured-with-basic-authentication-the) (info, published 10 Nov 2026) - [CVE-2026-111259: Embedded server weak session ID generation](https://junglewise.ai/threats/cve-2026-111259-the-embedded-server-generates-http-session-identifiers-with-a) (info, published 10 Nov 2026) - [CVE-2026-111258: Web application request routing security constraint bypass](https://junglewise.ai/threats/cve-2026-111258-the-optional-request-routing-feature-forwards-requests-to-their) (info, published 10 Nov 2026) - [CVE-2026-111239: SSH administration service authentication bypass](https://junglewise.ai/threats/cve-2026-111239-the-optional-ssh-administration-service-grants-full-access-to) (info, published 10 Nov 2026) - [CVE-2026-86532: JAAS login modules credential timing and username enumeration](https://junglewise.ai/threats/cve-2026-86532-the-bundled-jaas-login-modules-leak-whether-a-username-exists-and) (info, published 10 Nov 2026) - [CVE-2026-63282: Improper shell quote escaping leading to command injection](https://junglewise.ai/threats/cve-2026-63282-improper-shell-quote-escaping-when-processing-user-controlled) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-74841: Multitenant delegator cache exhaustion via request parameter](https://junglewise.ai/threats/cve-2026-74841-in-multitenant-deployments-contextfilter-and-loginworker-built-a) (info, published 5 Nov 2026) - [CVE-2026-105325: Accounting privilege escalation via missing permission check](https://junglewise.ai/threats/cve-2026-105325-missing-check-for-accounting-update-accounting-create-in) (info, published 5 Nov 2026) - [CVE-2024-12139: Error handling insufficient input validation in URL parameters](https://junglewise.ai/threats/cve-2024-12139-the-error-handling-implementation-fails-to-properly-sanitize-or) (medium, CVSS 4.3, published 2 Nov 2026) - [CVE-2024-12141: Open callback URL validation bypass](https://junglewise.ai/threats/cve-2024-12141-the-product-fails-to-sufficiently-validate-callback-urls-allowing) (medium, CVSS 4.3, published 2 Nov 2026) - [CVE-2024-7075: Management console user search XSS via input encoding failure](https://junglewise.ai/threats/cve-2024-7075-the-user-search-function-within-the-management-console-fails-to) (medium, CVSS 4.6, published 2 Nov 2026) - [CVE-2026-22114: HTTP basic authentication missing rate limiting](https://junglewise.ai/threats/cve-2026-22114-http-basic-auth-enforces-no-retry-limit-or-backoff-combined-with) (info, published 30 Oct 2026) - [CVE-2026-22109: WebUI template database hardcoded factory default passwords](https://junglewise.ai/threats/cve-2026-22109-the-shipped-webui-template-database-retains-the-factory-default) (info, published 30 Oct 2026) - [CVE-2026-82986: Group link sharing permission bypass](https://junglewise.ai/threats/cve-2026-82986-the-user-in-a-group-can-bypass-the-group-restriction-set-by-an) (medium, CVSS 4.6, published 27 Oct 2026) - [CVE-2026-82984: Team resource enumeration via API endpoint bypass](https://junglewise.ai/threats/cve-2026-82984-when-a-team-was-configured-as-visible-to-everyone-the-web-ui) (medium, CVSS 4.3, published 27 Oct 2026) - [CVE-2026-77173: Document file format confidentiality marking bypass with hash character in filename](https://junglewise.ai/threats/cve-2026-77173-a-user-could-create-a-docx-or-odt-file-with-a-in-the-filename) (medium, CVSS 4.3, published 27 Oct 2026) - [CVE-2026-77172: App passwords bypass password confirmation on sensitive endpoints](https://junglewise.ai/threats/cve-2026-77172-app-passwords-were-allowed-to-bypass-password-confirmation-on) (medium, CVSS 5.3, published 27 Oct 2026) - [CVE-2024-6423: Input validation bypass in URL parameter handling](https://junglewise.ai/threats/cve-2024-6423-the-product-failed-to-enforce-validation-constraints-on-user) (medium, CVSS 4, published 21 Oct 2026) - [CVE-2024-5563: reCAPTCHA bypass in authentication flows](https://junglewise.ai/threats/cve-2024-5563-due-to-an-incomplete-implementation-recaptcha-is-not-applied-to) (medium, CVSS 4.8, published 21 Oct 2026) - [CVE-2026-101290: Unknown product out-of-bounds memory read in packet handling](https://junglewise.ai/threats/cve-2026-101290-a-remote-attacker-may-send-a-specially-crafted-network-packet) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-88136: WebDAV path equivalence improper resolution code execution](https://junglewise.ai/threats/cve-2026-88136-improper-resolution-of-path-equivalence-in-webdav-allows-an) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-87714: WebDAV security feature bypass via missing authorization](https://junglewise.ai/threats/cve-2026-87714-missing-authorization-in-webdav-allows-an-authorized-attacker-to) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-84015: Remote Access Point-to-Point Protocol heap overflow in EAP-TLS](https://junglewise.ai/threats/cve-2026-84015-heap-based-buffer-overflow-in-remote-access-point-to-point) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2026-91191: Device update mechanism package authentication bypass](https://junglewise.ai/threats/cve-2026-91191-the-device-s-update-mechanism-includes-conditions-that-allow) (high, CVSS 7.5, published 29 Sep 2026) ## Most severe vulnerabilities - [CVE-2026-84015: Remote Access Point-to-Point Protocol heap overflow in EAP-TLS](https://junglewise.ai/threats/cve-2026-84015-heap-based-buffer-overflow-in-remote-access-point-to-point) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2026-25254: SocketIO improper authorization remote code execution](https://junglewise.ai/threats/cve-2026-25254-improper-authorization-leads-to-remote-code-execution-via) (critical, CVSS 9.8, published 22 Sep 2026) - [CVE-2026-88136: WebDAV path equivalence improper resolution code execution](https://junglewise.ai/threats/cve-2026-88136-improper-resolution-of-path-equivalence-in-webdav-allows-an) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-25255: gRPC server exposed dangerous function privilege escalation](https://junglewise.ai/threats/cve-2026-25255-exposed-dangerous-function-lead-to-privilege-escalation-via-grpc) (high, CVSS 8.8, published 22 Sep 2026) - [CVE-2026-101290: Unknown product out-of-bounds memory read in packet handling](https://junglewise.ai/threats/cve-2026-101290-a-remote-attacker-may-send-a-specially-crafted-network-packet) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-95784: System component denial of service vulnerability](https://junglewise.ai/threats/cve-2026-95784-a-vulnerability-exists-in-a-system-component-that-may-under) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-91191: Device update mechanism package authentication bypass](https://junglewise.ai/threats/cve-2026-91191-the-device-s-update-mechanism-includes-conditions-that-allow) (high, CVSS 7.5, published 29 Sep 2026) - [CVE-2026-87714: WebDAV security feature bypass via missing authorization](https://junglewise.ai/threats/cve-2026-87714-missing-authorization-in-webdav-allows-an-authorized-attacker-to) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-77165: Database file locking denial of service via TYPE_TOKEN locks](https://junglewise.ai/threats/cve-2026-77165-file-owners-were-unable-to-unlock-type-token-locks-placed-by) (medium, CVSS 6.5, published 21 Sep 2026) - [CVE-2026-63282: Improper shell quote escaping leading to command injection](https://junglewise.ai/threats/cve-2026-63282-improper-shell-quote-escaping-when-processing-user-controlled) (medium, CVSS 6.5, published 10 Nov 2026) ## Vulnerabilities per week 17 vulnerabilities in the last four weeks, up 240% on the four before (5). 1 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 4 | 1 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 4 | 1 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 6 | 0 | 0 | | 2 Nov 2026 | 5 | 0 | 0 | | 9 Nov 2026 | 7 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, " vulnerabilities", https://junglewise.ai/threats/technologies/x-unknown, 13 November 2026.