# Most vulnerable technologies: week of 27 July to 2 August 2026 (week 31)

Source: https://junglewise.ai/threats/weekly/2026-07-27  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 09:24 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-07-27.json  
License: CC BY 4.0 with a link back

In the week of 27 July to 2 August 2026, Junglewise Threat Intelligence recorded 2,117 new vulnerabilities: 114 critical, 426 high and 7 exploited in the wild. The most vulnerable technology was Google Chrome, with 340 vulnerabilities (0 critical), followed by Apple macOS (159) and Apache Traffic Server (36).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 340 | 0 | 0 | 0 | 10 |
| 2 | [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe) (Apple) | 159 | 0 | 0 | 0 | 5.5 |
| 3 | [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server) (Apache) | 36 | 6 | 21 | 0 | 10 |
| 4 | [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados) (Apple) | 84 | 0 | 0 | 0 | 5.5 |
| 5 | [Phoenix Contact CHARX SEC-3000](https://junglewise.ai/threats/technologies/charx-sec-3000) (Phoenix Contact) | 19 | 8 | 8 | 0 | 9.8 |
| 6 | [Phoenix Contact CHARX SEC-3050](https://junglewise.ai/threats/technologies/charx-sec-3050) (Phoenix Contact) | 19 | 8 | 8 | 0 | 9.8 |
| 7 | [Phoenix Contact CHARX SEC-3100](https://junglewise.ai/threats/technologies/charx-sec-3100) (Phoenix Contact) | 19 | 8 | 8 | 0 | 9.8 |
| 8 | [Phoenix Contact CHARX SEC-3150](https://junglewise.ai/threats/technologies/charx-sec-3150) (Phoenix Contact) | 19 | 8 | 8 | 0 | 9.8 |
| 9 | [Apple tvOS](https://junglewise.ai/threats/technologies/tvos) (Apple) | 66 | 0 | 0 | 0 | 5.5 |
| 10 | [Apple visionOS](https://junglewise.ai/threats/technologies/visionos) (Apple) | 65 | 0 | 0 | 0 | 5.5 |
| 11 | [Apple watchOS](https://junglewise.ai/threats/technologies/watchos) (Apple) | 62 | 0 | 0 | 0 | 5.5 |
| 12 | [IBM WebSphere Application Server](https://junglewise.ai/threats/technologies/websphere-application-server) (IBM) | 15 | 4 | 10 | 0 | 9.8 |
| 13 | [Axios](https://junglewise.ai/threats/technologies/axios) (Axios) | 28 | 0 | 12 | 0 | 7.5 |
| 14 | [Three Learning Koollab LMS](https://junglewise.ai/threats/technologies/koollab-lms) (Three Learning) | 16 | 6 | 1 | 0 | 9.9 |
| 15 | [IBM WebSphere Application Server Liberty](https://junglewise.ai/threats/technologies/websphere-application-server-liberty) (IBM) | 14 | 1 | 12 | 0 | 9.4 |
| 16 | [Koxudaxi Datamodel-Code-Generator](https://junglewise.ai/threats/technologies/datamodel-code-generator) (Koxudaxi) | 12 | 0 | 11 | 0 | 8.8 |
| 17 | [Google Chrome for iOS](https://junglewise.ai/threats/technologies/chrome-for-ios) (Google) | 33 | 0 | 0 | 0 | 8.8 |
| 18 | [Gitpython Project Gitpython](https://junglewise.ai/threats/technologies/gitpython) (Gitpython Project) | 9 | 2 | 7 | 0 | 9.8 |
| 19 | [VMware Cloud Foundation](https://junglewise.ai/threats/technologies/cloud-foundation) (VMware) | 5 | 3 | 1 | 1 | 9.8 |
| 20 | [N-able N-central](https://junglewise.ai/threats/technologies/n-central) (N-able) | 2 | 2 | 0 | 2 | 8.1 |
| 21 | [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10) (Red Hat) | 13 | 0 | 9 | 0 | 8.8 |
| 22 | [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss) (IBM) | 8 | 3 | 3 | 0 | 9.9 |
| 23 | [VMware vSphere Foundation](https://junglewise.ai/threats/technologies/vsphere-foundation) (VMware) | 4 | 3 | 0 | 1 | 9.8 |
| 24 | [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb) (ArcadeData) | 8 | 2 | 5 | 0 | 9.8 |
| 25 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 27 | 0 | 0 | 0 | 6.2 |

## Most affected vendors

1. [Google](https://junglewise.ai/threats/vendors/google): 380 vulnerabilities, 1 critical, 0 exploited
2. [IBM](https://junglewise.ai/threats/vendors/ibm): 68 vulnerabilities, 13 critical, 0 exploited
3. [Apple](https://junglewise.ai/threats/vendors/apple): 164 vulnerabilities, 0 critical, 0 exploited
4. [Apache](https://junglewise.ai/threats/vendors/apache): 46 vulnerabilities, 6 critical, 0 exploited
5. [Go](https://junglewise.ai/threats/vendors/go): 41 vulnerabilities, 6 critical, 0 exploited
6. [Npm](https://junglewise.ai/threats/vendors/npm): 45 vulnerabilities, 2 critical, 0 exploited
7. [Phoenix Contact](https://junglewise.ai/threats/vendors/phoenix-contact): 20 vulnerabilities, 8 critical, 0 exploited
8. [Red Hat](https://junglewise.ai/threats/vendors/red-hat): 39 vulnerabilities, 0 critical, 0 exploited
9. [Pip](https://junglewise.ai/threats/vendors/pypi): 29 vulnerabilities, 2 critical, 0 exploited
10. [Composer](https://junglewise.ai/threats/vendors/packagist): 25 vulnerabilities, 4 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-16812: Arista VeloCloud Orchestrator OS command injection in on-prem host](https://junglewise.ai/threats/cve-2026-16812-arista-velocloud-orchestrator-os-command-injection-in-on-prem) (critical, exploited in the wild, CVSS 10, published 27 Jul 2026)
- [CVE-2026-59310: VMware vCenter directory traversal in Syslog server](https://junglewise.ai/threats/cve-2026-59310-vmware-vcenter-directory-traversal-in-syslog-server) (critical, exploited in the wild, CVSS 9.8, published 30 Jul 2026)
- [CVE-2026-63077: JetBrains TeamCity remote code execution in agent polling protocol](https://junglewise.ai/threats/cve-2026-63077-jetbrains-teamcity-remote-code-execution-in-agent-polling) (critical, exploited in the wild, CVSS 9.8, published 27 Jul 2026)
- [CVE-2026-18577: An incomplete patch for allows for authentication bypass and account takeover in N-central Versions through 2026.3.1](https://junglewise.ai/threats/cve-2026-18577-n-able-n-central-authentication-bypass-and-account-takeover) (critical, exploited in the wild, CVSS 8.1, published 2 Aug 2026)
- [CVE-2026-42016: JFrog Artifactory privilege escalation via improper token scope validation](https://junglewise.ai/threats/cve-2026-42016-jfrog-artifactory-privilege-escalation-via-improper-token-scope) (critical, exploited in the wild, CVSS 8.1, published 27 Jul 2026)
- [CVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass…](https://junglewise.ai/threats/cve-2026-18556-n-able-n-central-authentication-bypass-via-alternate-path) (critical, exploited in the wild, CVSS 7.4, published 1 Aug 2026)
- [CVE-2026-20316: Cisco Secure Firewall Management Center static credentials in web interface](https://junglewise.ai/threats/cve-2026-20316-cisco-secure-firewall-management-center-static-credentials-in-web) (critical, exploited in the wild, CVSS 5.3, published 29 Jul 2026)
- [CVE-2026-67429: Flytohub Flyto2 Core path traversal in file-writing modules](https://junglewise.ai/threats/cve-2026-67429-flytohub-flyto2-core-path-traversal-in-file-writing-modules) (critical, CVSS 10, published 29 Jul 2026)
- [CVE-2026-18452: Rich Source DMS+ hard-coded API key](https://junglewise.ai/threats/cve-2026-18452-rich-source-dms-hard-coded-api-key) (critical, CVSS 10, published 31 Jul 2026)
- [CVE-2026-66803: Microsoft Azure Cosmos DB improper access control remote code execution](https://junglewise.ai/threats/cve-2026-66803-microsoft-azure-cosmos-db-improper-access-control-remote-code) (critical, CVSS 10, published 30 Jul 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 27 July to 2 August 2026 (week 31)", https://junglewise.ai/threats/weekly/2026-07-27, 26 September 2026.