# Most vulnerable technologies: week of 6 to 12 July 2026 (week 28)

Source: https://junglewise.ai/threats/weekly/2026-07-06  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 10:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-07-06.json  
License: CC BY 4.0 with a link back

In the week of 6 to 12 July 2026, Junglewise Threat Intelligence recorded 1,592 new vulnerabilities: 93 critical, 461 high and 2 exploited in the wild. The most vulnerable technology was Apache Camel, with 29 vulnerabilities (7 critical), followed by Coollabs Coolify (34) and Coder (21).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Apache Camel](https://junglewise.ai/threats/technologies/camel) (Apache) | 29 | 7 | 13 | 0 | 9.8 |
| 2 | [Coollabs Coolify](https://junglewise.ai/threats/technologies/coolify) (Coollabs) | 34 | 4 | 16 | 0 | 9.9 |
| 3 | [Coder](https://junglewise.ai/threats/technologies/coder) (Coder) | 21 | 1 | 10 | 0 | 9.1 |
| 4 | [Capgo](https://junglewise.ai/threats/technologies/capgo) (Capgo) | 24 | 0 | 10 | 0 | 8.3 |
| 5 | [Pip Open-Webui](https://junglewise.ai/threats/technologies/open-webui) (Pip) | 22 | 0 | 8 | 0 | 8 |
| 6 | [Npm 9router](https://junglewise.ai/threats/technologies/9router) (Npm) | 8 | 3 | 5 | 0 | 10 |
| 7 | [N8n](https://junglewise.ai/threats/technologies/n8n) (N8n) | 19 | 0 | 6 | 0 | 8.8 |
| 8 | [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it) (Snipeitapp) | 20 | 0 | 5 | 0 | 8.7 |
| 9 | [Composer Snipe/Snipe-It](https://junglewise.ai/threats/technologies/snipe-snipe-it) (Composer) | 20 | 0 | 5 | 0 | 8.7 |
| 10 | [Pip Crawl4ai](https://junglewise.ai/threats/technologies/crawl4ai) (Pip) | 6 | 3 | 3 | 0 | 10 |
| 11 | [Pip Langroid](https://junglewise.ai/threats/technologies/langroid) (Pip) | 6 | 3 | 3 | 0 | 10 |
| 12 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 26 | 0 | 0 | 0 | 9.8 |
| 13 | [Dell PowerProtect Data Domain](https://junglewise.ai/threats/technologies/powerprotect-data-domain) (Dell) | 7 | 2 | 4 | 0 | 9.8 |
| 14 | [CoreWCF](https://junglewise.ai/threats/technologies/corewcf) (CoreWCF) | 11 | 1 | 4 | 0 | 10 |
| 15 | [NATS Server](https://junglewise.ai/threats/technologies/nats-server) (NATS) | 12 | 0 | 5 | 0 | 8.8 |
| 16 | [Berriai LiteLLM](https://junglewise.ai/threats/technologies/litellm) (Berriai) | 4 | 1 | 0 | 1 | 4 |
| 17 | [Kirby](https://junglewise.ai/threats/technologies/kirby) (Kirby) | 7 | 1 | 3 | 0 | 9.1 |
| 18 | [FOSSBilling](https://junglewise.ai/threats/technologies/fossbilling) (FOSSBilling) | 17 | 0 | 0 | 0 | 9.2 |
| 19 | [Discourse](https://junglewise.ai/threats/technologies/discourse) (Discourse) | 11 | 0 | 3 | 0 | 8.2 |
| 20 | [ZITADEL](https://junglewise.ai/threats/technologies/zitadel) (ZITADEL) | 9 | 0 | 3 | 0 | 8.1 |
| 21 | [Pip Mistune](https://junglewise.ai/threats/technologies/mistune) (Pip) | 9 | 0 | 3 | 0 | 7.5 |
| 22 | [Rubygems Fluentd](https://junglewise.ai/threats/technologies/fluentd) (Rubygems) | 4 | 1 | 3 | 0 | 9.8 |
| 23 | [Progress MOVEit Transfer](https://junglewise.ai/threats/technologies/moveit-transfer) (Progress) | 8 | 0 | 3 | 0 | 8 |
| 24 | [Pip Pillow](https://junglewise.ai/threats/technologies/pillow) (Pip) | 5 | 0 | 4 | 0 | 7.5 |
| 25 | [GitLab Enterprise Edition](https://junglewise.ai/threats/technologies/gitlab-ee) (GitLab) | 8 | 0 | 2 | 0 | 8.7 |

## Most affected vendors

1. [Pip](https://junglewise.ai/threats/vendors/pypi): 77 vulnerabilities, 5 critical, 0 exploited
2. [Apache](https://junglewise.ai/threats/vendors/apache): 37 vulnerabilities, 8 critical, 0 exploited
3. [Npm](https://junglewise.ai/threats/vendors/npm): 44 vulnerabilities, 4 critical, 0 exploited
4. [Coollabs](https://junglewise.ai/threats/vendors/coollabs): 34 vulnerabilities, 4 critical, 0 exploited
5. [Go](https://junglewise.ai/threats/vendors/go): 38 vulnerabilities, 3 critical, 0 exploited
6. [Composer](https://junglewise.ai/threats/vendors/packagist): 37 vulnerabilities, 1 critical, 0 exploited
7. [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation): 28 vulnerabilities, 4 critical, 0 exploited
8. [Capgo](https://junglewise.ai/threats/vendors/capgo): 25 vulnerabilities, 0 critical, 0 exploited
9. [Coder](https://junglewise.ai/threats/vendors/coder): 21 vulnerabilities, 1 critical, 0 exploited
10. [Dell](https://junglewise.ai/threats/vendors/dell): 13 vulnerabilities, 3 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-56291: Balbooa Forms for Joomla unauthenticated file upload RCE](https://junglewise.ai/threats/cve-2026-56291-balbooa-forms-for-joomla-unauthenticated-file-upload-rce) (critical, exploited in the wild, CVSS 10, published 9 Jul 2026)
- [CVE-2026-59822: BerriAI LiteLLM authentication bypass in MCP endpoint](https://junglewise.ai/threats/cve-2026-59822-berriai-litellm-authentication-bypass-in-mcp-endpoint) (critical, exploited in the wild, CVSS 4, published 8 Jul 2026)
- [CVE-2026-61447: MervinPraison PraisonAI remote code execution in CodeAgent](https://junglewise.ai/threats/cve-2026-61447-mervinpraison-praisonai-remote-code-execution-in-codeagent) (critical, CVSS 10, published 11 Jul 2026)
- [CVE-2026-54769: Langroid sandbox escape and RCE in TableChatAgent and VectorStore](https://junglewise.ai/threats/cve-2026-54769-langroid-sandbox-escape-and-rce-in-tablechatagent-and-vectorstore) (critical, CVSS 10, published 10 Jul 2026)
- [CVE-2026-59726: ruvnet Ruflo unauthenticated RCE in MCP bridge](https://junglewise.ai/threats/cve-2026-59726-ruvnet-ruflo-unauthenticated-rce-in-mcp-bridge) (critical, CVSS 10, published 9 Jul 2026)
- [CVE-2026-54782: CoreWCF authentication bypass in SAML token validation](https://junglewise.ai/threats/cve-2026-54782-corewcf-authentication-bypass-in-saml-token-validation) (critical, CVSS 10, published 8 Jul 2026)
- [Decolua 9Router multiple authentication bypasses and sensitive data leaks](https://junglewise.ai/threats/cve-2026-59801-decolua-9router-missing-authentication-in-management-api) (critical, CVSS 10, published 6 Jul 2026)
- [CVE-2026-57572: unclecode Crawl4AI remote code execution in Docker API server](https://junglewise.ai/threats/cve-2026-57572-unclecode-crawl4ai-remote-code-execution-in-docker-api-server) (critical, CVSS 10, published 6 Jul 2026)
- [CVE-2026-48316: Adobe ColdFusion improper input validation code execution](https://junglewise.ai/threats/cve-2026-48316-adobe-coldfusion-improper-input-validation-code-execution) (critical, CVSS 10, published 6 Jul 2026)
- [CVE-2026-55500: decolua 9Router authentication bypass in database export and import](https://junglewise.ai/threats/cve-2026-55500-decolua-9router-authentication-bypass-in-database-export-and) (critical, CVSS 9.9, published 10 Jul 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 6 to 12 July 2026 (week 28)", https://junglewise.ai/threats/weekly/2026-07-06, 26 September 2026.