# Most vulnerable technologies: week of 13 to 19 July 2026 (week 29)

Source: https://junglewise.ai/threats/weekly/2026-07-13  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 10:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-07-13.json  
License: CC BY 4.0 with a link back

In the week of 13 to 19 July 2026, Junglewise Threat Intelligence recorded 2,803 new vulnerabilities: 161 critical, 1,009 high and 14 exploited in the wild. The most vulnerable technology was Microsoft Windows 11, with 367 vulnerabilities (8 critical), followed by Microsoft Windows 10 (318) and Microsoft Windows Server 2012 (163).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Microsoft Windows 11](https://junglewise.ai/threats/technologies/windows-11) (Microsoft) | 367 | 8 | 265 | 0 | 9.9 |
| 2 | [Microsoft Windows 10](https://junglewise.ai/threats/technologies/windows-10) (Microsoft) | 318 | 10 | 218 | 1 | 9.9 |
| 3 | [Microsoft Windows Server 2012](https://junglewise.ai/threats/technologies/windows-server-2012) (Microsoft) | 163 | 9 | 109 | 1 | 9.9 |
| 4 | [Microsoft Windows 11 24h2](https://junglewise.ai/threats/technologies/windows-11-24h2) (Microsoft) | 152 | 3 | 110 | 0 | 9.8 |
| 5 | [Microsoft Windows 11 Version 26H1](https://junglewise.ai/threats/technologies/windows-11-version-26h1) (Microsoft) | 128 | 2 | 99 | 0 | 9.8 |
| 6 | [Microsoft Windows 11 25h2](https://junglewise.ai/threats/technologies/windows-11-25h2) (Microsoft) | 124 | 2 | 95 | 0 | 9.8 |
| 7 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 321 | 0 | 0 | 0 | 8.1 |
| 8 | [Microsoft Windows Server 2025](https://junglewise.ai/threats/technologies/windows-server-2025) (Microsoft) | 83 | 1 | 67 | 0 | 9.8 |
| 9 | [Microsoft Windows Server 2019](https://junglewise.ai/threats/technologies/windows-server-2019) (Microsoft) | 80 | 3 | 57 | 1 | 9.8 |
| 10 | [Microsoft Windows 10 21h2](https://junglewise.ai/threats/technologies/windows-10-21h2) (Microsoft) | 86 | 2 | 52 | 0 | 9.8 |
| 11 | [Microsoft Windows 10 22h2](https://junglewise.ai/threats/technologies/windows-10-22h2) (Microsoft) | 86 | 2 | 52 | 0 | 9.8 |
| 12 | [Microsoft Windows Server 2016](https://junglewise.ai/threats/technologies/windows-server-2016) (Microsoft) | 73 | 3 | 50 | 1 | 9.8 |
| 13 | [Microsoft Windows Server 2022](https://junglewise.ai/threats/technologies/windows-server-2022) (Microsoft) | 80 | 0 | 57 | 0 | 8.8 |
| 14 | [Microsoft Windows 10 1809](https://junglewise.ai/threats/technologies/windows-10-1809) (Microsoft) | 74 | 4 | 48 | 0 | 9.8 |
| 15 | [Microsoft 365 Apps for Enterprise](https://junglewise.ai/threats/technologies/365-apps-for-enterprise) (Microsoft) | 70 | 0 | 48 | 0 | 8.4 |
| 16 | [Microsoft Office LTSC 2021](https://junglewise.ai/threats/technologies/office-ltsc-2021) (Microsoft) | 68 | 0 | 47 | 0 | 8.4 |
| 17 | [Microsoft Office LTSC 2024](https://junglewise.ai/threats/technologies/office-ltsc-2024) (Microsoft) | 68 | 0 | 47 | 0 | 8.4 |
| 18 | [Microsoft Office 2019](https://junglewise.ai/threats/technologies/office-2019) (Microsoft) | 67 | 0 | 46 | 0 | 8.4 |
| 19 | [Microsoft Windows 10 1607](https://junglewise.ai/threats/technologies/windows-10-1607) (Microsoft) | 59 | 4 | 38 | 0 | 9.8 |
| 20 | [Microsoft Office 365 for Mac](https://junglewise.ai/threats/technologies/office-365-for-mac) (Microsoft) | 64 | 0 | 43 | 0 | 8.4 |
| 21 | [Microsoft SharePoint Enterprise Server 2016](https://junglewise.ai/threats/technologies/sharepoint-enterprise-server-2016) (Microsoft) | 32 | 4 | 9 | 4 | 9.8 |
| 22 | [Microsoft SharePoint Server 2019](https://junglewise.ai/threats/technologies/sharepoint-server-2019) (Microsoft) | 26 | 4 | 7 | 4 | 9.8 |
| 23 | [Openclaw](https://junglewise.ai/threats/technologies/openclaw) (Openclaw) | 39 | 0 | 30 | 0 | 8.8 |
| 24 | [Microsoft SharePoint Server Subscription Edition](https://junglewise.ai/threats/technologies/sharepoint-server-subscription-edition) (Microsoft) | 22 | 4 | 7 | 4 | 9.8 |
| 25 | [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss) (IBM) | 18 | 10 | 8 | 1 | 9.9 |

## Most affected vendors

1. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 592 vulnerabilities, 22 critical, 5 exploited
2. [Linux](https://junglewise.ai/threats/vendors/linux): 321 vulnerabilities, 0 critical, 0 exploited
3. [Adobe](https://junglewise.ai/threats/vendors/adobe): 91 vulnerabilities, 13 critical, 0 exploited
4. [Npm](https://junglewise.ai/threats/vendors/npm): 63 vulnerabilities, 14 critical, 0 exploited
5. [Composer](https://junglewise.ai/threats/vendors/packagist): 71 vulnerabilities, 8 critical, 0 exploited
6. [IBM](https://junglewise.ai/threats/vendors/ibm): 34 vulnerabilities, 11 critical, 1 exploited
7. [Pip](https://junglewise.ai/threats/vendors/pypi): 42 vulnerabilities, 5 critical, 0 exploited
8. [Openclaw](https://junglewise.ai/threats/vendors/openclaw): 43 vulnerabilities, 0 critical, 0 exploited
9. [Go](https://junglewise.ai/threats/vendors/go): 31 vulnerabilities, 1 critical, 0 exploited
10. [Nvidia](https://junglewise.ai/threats/vendors/nvidia): 23 vulnerabilities, 0 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-50522: Microsoft SharePoint remote code execution via unsafe deserialization](https://junglewise.ai/threats/cve-2026-50522-microsoft-sharepoint-remote-code-execution-via-unsafe) (critical, exploited in the wild, CVSS 9.8, published 14 Jul 2026)
- [CVE-2026-9198: IBM Langflow OSS remote code execution via auto-login bypass](https://junglewise.ai/threats/cve-2026-9198-ibm-langflow-oss-remote-code-execution-via-auto-login-bypass) (critical, exploited in the wild, CVSS 9.8, published 17 Jul 2026)
- [CVE-2026-58644: Microsoft SharePoint remote code execution via untrusted deserialization](https://junglewise.ai/threats/cve-2026-58644-microsoft-sharepoint-remote-code-execution-via-untrusted) (critical, exploited in the wild, CVSS 9.8, published 14 Jul 2026)
- [CVE-2026-9586: Sangoma Switchvox SMB SQL injection in /pa endpoint](https://junglewise.ai/threats/cve-2026-9586-sangoma-switchvox-smb-sql-injection-in-pa-endpoint) (critical, exploited in the wild, CVSS 9.3, published 17 Jul 2026)
- [CVE-2008-4128: Cisco IOS CSRF in HTTP Administration component](https://junglewise.ai/threats/cve-2008-4128-cisco-ios-csrf-in-http-administration-component) (critical, exploited in the wild, CVSS 9.3, published 13 Jul 2026)
- [CVE-2026-55040: Microsoft SharePoint weak authentication security feature bypass](https://junglewise.ai/threats/cve-2026-55040-microsoft-sharepoint-weak-authentication-security-feature-bypass) (critical, exploited in the wild, CVSS 9.1, published 14 Jul 2026)
- [CVE-2026-60137: WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter) (critical, exploited in the wild, CVSS 9.1, published 17 Jul 2026)
- [CVE-2021-27137: DD-WRT stack buffer overflow in UPnP SSDP parser](https://junglewise.ai/threats/cve-2021-27137-dd-wrt-stack-buffer-overflow-in-upnp-ssdp-parser) (critical, exploited in the wild, CVSS 8.1, published 16 Jul 2026)
- [CVE-2026-56155: Microsoft AD FS privilege escalation via insufficient access control granularity](https://junglewise.ai/threats/cve-2026-56155-microsoft-ad-fs-privilege-escalation-via-insufficient-access) (critical, exploited in the wild, CVSS 7.8, published 14 Jul 2026)
- [CVE-2026-63030: WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to) (critical, exploited in the wild, CVSS 7.5, published 17 Jul 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 13 to 19 July 2026 (week 29)", https://junglewise.ai/threats/weekly/2026-07-13, 26 September 2026.