# Unknown vulnerabilities Source: https://junglewise.ai/threats/vendors/unknown Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/unknown.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 118 vulnerabilities in Unknown: 6 in the last 7 days and 70 in the last 90 days, 9 of them critical and 0 exploited in the wild. The most recent, CVE-2026-81384, was published on 10 November 2026. 26 vulnerabilities in the last four weeks, down 21% on the four before (33). 3 critical against 2. 2 technologies have a page of their own. ## Counts - Last 7 days: 6 - Last 30 days: 28 - Last 90 days: 70 - All time: 118 (9 critical, 0 exploited in the wild) ## About Unknown A placeholder designation used when the specific vendor of a product has not been identified. ## Latest Unknown vulnerabilities - [CVE-2026-81384: DNS Server heap buffer overflow allows remote code execution](https://junglewise.ai/threats/cve-2026-81384-heap-based-buffer-overflow-in-dns-server-allows-an-unauthorized) (high, CVSS 8.1, published 10 Nov 2026) - [CVE-2026-99285: Linux kernel netfilter nft_byteorder multi-register bypass](https://junglewise.ai/threats/cve-2026-99285-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 10 Nov 2026) - [CVE-2026-97872: Java EJB authentication bypass over Hessian protocol](https://junglewise.ai/threats/cve-2026-97872-when-an-ejb-is-exposed-over-the-optional-hessian-protocol-inside) (info, published 10 Nov 2026) - [CVE-2026-87755: Enterprise Java Beans session identifier weak randomness](https://junglewise.ai/threats/cve-2026-87755-stateful-session-bean-identifiers-are-not-generated-from-a) (info, published 10 Nov 2026) - [gabby-types-sec malicious code in Rust crate](https://junglewise.ai/threats/rustsec-2026-0470-gabby-types-sec-was-removed-from-crates-io-for-6e7f1340) (info, published 9 Nov 2026) - [top_level_crate malicious code with telemetry exfiltration](https://junglewise.ai/threats/rustsec-2026-0467-top-level-crate-was-removed-from-crates-io-for-2a17222d) (info, published 6 Nov 2026) - [CVE-2026-99257: Linux kernel GPIO null pointer dereference in shared GPIO lookup](https://junglewise.ai/threats/cve-2026-99257-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 3 Nov 2026) - [CVE-2025-5769: Authentication endpoint stored cross-site scripting](https://junglewise.ai/threats/cve-2025-5769-the-authentication-endpoint-does-not-properly-encode-user-supplied) (medium, CVSS 6.1, published 3 Nov 2026) - [CVE-2026-99241: Linux kernel NTFS race condition in page fault handler](https://junglewise.ai/threats/cve-2026-99241-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 2 Nov 2026) - [CVE-2024-2372: Open redirection vulnerability in URL handling](https://junglewise.ai/threats/cve-2024-2372-the-affected-components-accept-user-supplied-input-for) (medium, CVSS 5.4, published 2 Nov 2026) - [CVE-2026-62012: Coinpress PHP Object Injection](https://junglewise.ai/threats/cve-2026-62012-unauthenticated-php-object-injection-in-coinpress-1-0-15-versions) (critical, CVSS 9.8, published 29 Oct 2026) - [CVE-2026-116867: Dynamic QR Code Generator PHP object injection](https://junglewise.ai/threats/cve-2026-116867-contributor-php-object-injection-in-dynamic-qr-code-8211) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-99146: Linux kernel i915 DMC firmware load address validation bypass](https://junglewise.ai/threats/cve-2026-99146-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 28 Oct 2026) - [CVE-2026-99098: Linux kernel dm-integrity buffer overflow in inline mode](https://junglewise.ai/threats/cve-2026-99098-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 26 Oct 2026) - [CVE-2026-116097: CloudClassroom-PHP-Project stored XSS in addnewstudent.php](https://junglewise.ai/threats/cve-2026-116097-a-security-vulnerability-has-been-detected-in-cloudclassroom-php) (medium, CVSS 4.3, published 26 Oct 2026) - [CVE-2026-99047: Linux kernel GVE XSK buffer memory leak when stopping rings](https://junglewise.ai/threats/cve-2026-99047-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 23 Oct 2026) - [CVE-2026-99034: Linux kernel sdhci-sprd runtime PM cleanup on remove](https://junglewise.ai/threats/cve-2026-99034-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 23 Oct 2026) - [CVE-2026-99020: Linux kernel tps6594-regulator array bounds read in BUCK2-4](https://junglewise.ai/threats/cve-2026-99020-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 23 Oct 2026) - [CVE-2026-98876: Linux kernel host1x bus NULL pointer dereference in error teardown](https://junglewise.ai/threats/cve-2026-98876-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 23 Oct 2026) - [CVE-2026-98874: Linux kernel iwlwifi driver incorrect WARN_ON in WoWLAN suspend](https://junglewise.ai/threats/cve-2026-98874-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 23 Oct 2026) - [CVE-2026-79847: ](https://junglewise.ai/threats/cve-2026-79847-no-description-provided) (critical, CVSS 10, published 22 Oct 2026) - [CVE-2026-98722: Linux kernel block2mtd divide-by-zero on zero erase_size](https://junglewise.ai/threats/cve-2026-98722-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 18 Oct 2026) - [CVE-2026-98678: Linux kernel ad4030 ADC input validation bypass](https://junglewise.ai/threats/cve-2026-98678-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 18 Oct 2026) - [CVE-2026-98674: Linux kernel adi-axi-adc uninitialized mutex in state access](https://junglewise.ai/threats/cve-2026-98674-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 18 Oct 2026) - [CVE-2026-98633: Linux kernel Bluetooth btnxpuart memory leak in firmware dump](https://junglewise.ai/threats/cve-2026-98633-in-the-linux-kernel-the-following-vulnerability-has-been-resolved) (info, published 18 Oct 2026) ## Most severe Unknown vulnerabilities - [CVE-2026-79847: ](https://junglewise.ai/threats/cve-2026-79847-no-description-provided) (critical, CVSS 10, published 22 Oct 2026) - [CVE-1999-0192: Multiple Vendors telnetd buffer overflow in tgetent via TERMCAP](https://junglewise.ai/threats/cve-1999-0192-multiple-vendors-telnetd-buffer-overflow-in-tgetent-via-termcap) (critical, CVSS 10, published 18 Oct 1997) - [CVE-1999-0082: ftpd unauthorized root access via CWD ~root command](https://junglewise.ai/threats/cve-1999-0082-ftpd-unauthorized-root-access-via-cwd-root-command) (critical, CVSS 10, published 11 Nov 1988) - [CVE-2026-74001: User Registration & Membership Pro authentication bypass](https://junglewise.ai/threats/cve-2026-74001-user-registration-membership-pro-authentication-bypass) (critical, CVSS 9.8, published 20 Aug 2026) - [CVE-2026-86707: WordPress Private Feed Key authentication bypass](https://junglewise.ai/threats/cve-2026-86707-wordpress-private-feed-key-authentication-bypass) (critical, CVSS 9.8, published 17 Sep 2026) - [CVE-2026-62012: Coinpress PHP Object Injection](https://junglewise.ai/threats/cve-2026-62012-unauthenticated-php-object-injection-in-coinpress-1-0-15-versions) (critical, CVSS 9.8, published 29 Oct 2026) - [CVE-2026-49104: WordPress Integration for Keap/Infusionsoft PHP Object Injection](https://junglewise.ai/threats/cve-2026-49104-wordpress-integration-for-keap-infusionsoft-php-object-injection) (critical, CVSS 9.8, published 15 Jun 2026) - [CVE-2026-99999: Linux kernel memory corruption in virtio-net/TAP](https://junglewise.ai/threats/cve-2026-99999-issue-in-the-linux-kernel-virtio-net-tap-networking-path) (critical, CVSS 9.3, published 15 Oct 2026) - [CVE-2026-96822: Books Gallery SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-96822-unauthenticated-sql-injection-in-books-gallery-4-8-3-versions) (critical, CVSS 9.3, published 30 Sep 2026) - [CVE-2026-87764: BuddyPress Instant Chat stored XSS in chat messages](https://junglewise.ai/threats/cve-2026-87764-the-buddypress-instant-chat-wordpress-plugin-through-1-6-does-not) (high, CVSS 8.8, published 11 Oct 2026) ## Vulnerabilities per week 26 vulnerabilities in the last four weeks, down 21% on the four before (33). 3 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 1 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 3 | 0 | 0 | | 14 Sep 2026 | 3 | 1 | 0 | | 21 Sep 2026 | 13 | 0 | 0 | | 28 Sep 2026 | 5 | 1 | 0 | | 5 Oct 2026 | 12 | 0 | 0 | | 12 Oct 2026 | 10 | 1 | 0 | | 19 Oct 2026 | 6 | 1 | 0 | | 26 Oct 2026 | 5 | 1 | 0 | | 2 Nov 2026 | 5 | 0 | 0 | | 9 Nov 2026 | 5 | 0 | 0 | ## Unknown technologies - [Unknown Linux kernel](https://junglewise.ai/threats/technologies/unknown-linux-kernel): 30 vulnerabilities - [Unknown ](https://junglewise.ai/threats/technologies/unknown-unknown): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Unknown vulnerabilities", https://junglewise.ai/threats/vendors/unknown, 13 November 2026.