# Most vulnerable technologies: week of 29 June to 5 July 2026 (week 27)

Source: https://junglewise.ai/threats/weekly/2026-06-29  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 10:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-06-29.json  
License: CC BY 4.0 with a link back

In the week of 29 June to 5 July 2026, Junglewise Threat Intelligence recorded 1,993 new vulnerabilities: 125 critical, 544 high and 4 exploited in the wild. The most vulnerable technology was Google Chrome, with 427 vulnerabilities (0 critical), followed by Go Code.gitea.io/Gitea (38) and Gitea (39).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 427 | 0 | 0 | 0 | 10 |
| 2 | [Go Code.gitea.io/Gitea](https://junglewise.ai/threats/technologies/code-gitea-io-gitea) (Go) | 38 | 9 | 21 | 0 | 9.8 |
| 3 | [Gitea](https://junglewise.ai/threats/technologies/gitea) (Gitea) | 39 | 8 | 22 | 0 | 9.8 |
| 4 | [Microsoft Edge](https://junglewise.ai/threats/technologies/edge-chromium-based) (Microsoft) | 42 | 1 | 30 | 0 | 9 |
| 5 | [Pip Picklescan](https://junglewise.ai/threats/technologies/picklescan) (Pip) | 24 | 0 | 23 | 0 | 8.1 |
| 6 | [Openclaw](https://junglewise.ai/threats/technologies/openclaw) (Openclaw) | 29 | 1 | 15 | 0 | 9.3 |
| 7 | [Adobe ColdFusion](https://junglewise.ai/threats/technologies/coldfusion) (Adobe) | 10 | 7 | 2 | 1 | 10 |
| 8 | [Pip Openbabel](https://junglewise.ai/threats/technologies/openbabel) (Pip) | 22 | 0 | 17 | 0 | 7.8 |
| 9 | [Geovision GeoWebPlayer](https://junglewise.ai/threats/technologies/geowebplayer) (Geovision) | 18 | 0 | 18 | 0 | 8.8 |
| 10 | [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss) (IBM) | 11 | 7 | 4 | 0 | 10 |
| 11 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 28 | 1 | 1 | 1 | 8.8 |
| 12 | [Openbabel Open Babel](https://junglewise.ai/threats/technologies/open-babel) (Openbabel) | 14 | 0 | 13 | 0 | 7.8 |
| 13 | [SourceCodester Class and Exam Timetabling System](https://junglewise.ai/threats/technologies/class-and-exam-timetabling-system) (SourceCodester) | 13 | 0 | 13 | 0 | 7.3 |
| 14 | [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados) (Apple) | 37 | 0 | 0 | 0 | 6.1 |
| 15 | [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe) (Apple) | 36 | 0 | 0 | 0 | 6.1 |
| 16 | [Nvidia Megatron-Bridge](https://junglewise.ai/threats/technologies/megatron-bridge) (Nvidia) | 11 | 0 | 11 | 0 | 7.8 |
| 17 | [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9) (Red Hat) | 19 | 1 | 4 | 0 | 9.8 |
| 18 | [Capgo](https://junglewise.ai/threats/technologies/capgo) (Capgo) | 15 | 0 | 8 | 0 | 8.8 |
| 19 | [Rubygems Oj](https://junglewise.ai/threats/technologies/oj) (Rubygems) | 11 | 0 | 10 | 0 | 8.7 |
| 20 | [Apple Safari](https://junglewise.ai/threats/technologies/safari) (Apple) | 30 | 0 | 0 | 0 | 4.3 |
| 21 | [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8) (Red Hat) | 18 | 1 | 3 | 0 | 9.8 |
| 22 | [Rust Surrealdb](https://junglewise.ai/threats/technologies/surrealdb) (Rust) | 20 | 0 | 4 | 0 | 8.8 |
| 23 | [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10) (Red Hat) | 17 | 1 | 3 | 0 | 9.8 |
| 24 | [Ubiquiti Cloud Gateway](https://junglewise.ai/threats/technologies/cloud-gateway) (Ubiquiti) | 7 | 2 | 5 | 0 | 9.9 |
| 25 | [Ubiquiti Dream Machine](https://junglewise.ai/threats/technologies/dream-machine) (Ubiquiti) | 7 | 2 | 5 | 0 | 9.9 |

## Most affected vendors

1. [Google](https://junglewise.ai/threats/vendors/google): 438 vulnerabilities, 1 critical, 0 exploited
2. [Go](https://junglewise.ai/threats/vendors/go): 52 vulnerabilities, 10 critical, 0 exploited
3. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 50 vulnerabilities, 4 critical, 0 exploited
4. [Gitea](https://junglewise.ai/threats/vendors/gitea): 40 vulnerabilities, 9 critical, 0 exploited
5. [IBM](https://junglewise.ai/threats/vendors/ibm): 42 vulnerabilities, 10 critical, 0 exploited
6. [Npm](https://junglewise.ai/threats/vendors/npm): 44 vulnerabilities, 2 critical, 0 exploited
7. [Pip](https://junglewise.ai/threats/vendors/pypi): 30 vulnerabilities, 1 critical, 0 exploited
8. [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester): 33 vulnerabilities, 0 critical, 0 exploited
9. [Ubiquiti](https://junglewise.ai/threats/vendors/ubiquiti): 20 vulnerabilities, 4 critical, 0 exploited
10. [Adobe](https://junglewise.ai/threats/vendors/adobe): 11 vulnerabilities, 8 critical, 1 exploited

## Most severe vulnerabilities

- [CVE-2026-48282: Adobe ColdFusion path traversal in multiple versions](https://junglewise.ai/threats/cve-2026-48282-adobe-coldfusion-path-traversal-in-multiple-versions) (critical, exploited in the wild, CVSS 10, published 30 Jun 2026)
- [CVE-2026-56290: Joomlack Page Builder CK unauthenticated arbitrary file upload](https://junglewise.ai/threats/cve-2026-56290-joomlack-page-builder-ck-unauthenticated-arbitrary-file-upload) (critical, exploited in the wild, CVSS 10, published 29 Jun 2026)
- [CVE-2026-8452: NetScaler ADC and Gateway memory overflow in Gateway or AAA virtual server](https://junglewise.ai/threats/cve-2026-8452-netscaler-adc-and-gateway-memory-overflow-in-gateway-or-aaa) (critical, exploited in the wild, CVSS 8.8, published 30 Jun 2026)
- [CVE-2026-53362: Linux Kernel buffer overflow in IPv6 paged allocation](https://junglewise.ai/threats/cve-2026-53362-linux-kernel-buffer-overflow-in-ipv6-paged-allocation) (critical, exploited in the wild, CVSS 6.2, published 4 Jul 2026)
- [CVE-2026-13768: Gardyn IoT Hub hard-coded privileged key exposure](https://junglewise.ai/threats/cve-2026-13768-gardyn-iot-hub-hard-coded-privileged-key-exposure) (critical, CVSS 10, published 3 Jul 2026)
- [CVE-2026-50746: Ubiquiti UniFi Connect command injection via improper access control](https://junglewise.ai/threats/cve-2026-50746-ubiquiti-unifi-connect-command-injection-via-improper-access) (critical, CVSS 10, published 2 Jul 2026)
- [CVE-2026-57624: Creative Themes Blocksy Companion Pro unauthenticated RCE](https://junglewise.ai/threats/cve-2026-57624-creative-themes-blocksy-companion-pro-unauthenticated-rce) (critical, CVSS 10, published 2 Jul 2026)
- [CVE-2026-50160: Hoppscotch mass assignment in onboarding config endpoint](https://junglewise.ai/threats/cve-2026-50160-hoppscotch-mass-assignment-in-onboarding-config-endpoint) (critical, CVSS 10, published 1 Jul 2026)
- [CVE-2026-56415: StoneFly Storage Concentrator command injection in debug.pl](https://junglewise.ai/threats/cve-2026-56415-stonefly-storage-concentrator-command-injection-in-debug-pl) (critical, CVSS 10, published 30 Jun 2026)
- [CVE-2026-56413: StoneFly Storage Concentrator command injection in ms_service.pl](https://junglewise.ai/threats/cve-2026-56413-stonefly-storage-concentrator-command-injection-in-ms-service-pl) (critical, CVSS 10, published 30 Jun 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 29 June to 5 July 2026 (week 27)", https://junglewise.ai/threats/weekly/2026-06-29, 26 September 2026.