# Most vulnerable technologies: week of 3 to 9 August 2026 (week 32)

Source: https://junglewise.ai/threats/weekly/2026-08-03  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 09:24 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-08-03.json  
License: CC BY 4.0 with a link back

In the week of 3 to 9 August 2026, Junglewise Threat Intelligence recorded 670 new vulnerabilities: 90 critical, 238 high and 2 exploited in the wild. The most vulnerable technology was Npm Flowise, with 29 vulnerabilities (11 critical), followed by D-Link DWR-M961 (15) and Npm Flowise-Components (12).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Npm Flowise](https://junglewise.ai/threats/technologies/flowise) (Npm) | 29 | 11 | 14 | 0 | 10 |
| 2 | [D-Link DWR-M961](https://junglewise.ai/threats/technologies/dwr-m961) (D-Link) | 15 | 15 | 0 | 0 | 9.8 |
| 3 | [Npm Flowise-Components](https://junglewise.ai/threats/technologies/flowise-components) (Npm) | 12 | 9 | 2 | 0 | 9.8 |
| 4 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 19 | 2 | 11 | 0 | 9.8 |
| 5 | [Progress Marklogic Server](https://junglewise.ai/threats/technologies/marklogic-server) (Progress) | 10 | 7 | 3 | 0 | 9.9 |
| 6 | [Nvidia Dynamo](https://junglewise.ai/threats/technologies/dynamo) (Nvidia) | 15 | 1 | 10 | 0 | 9.8 |
| 7 | [OpenReception Appointment-Booking-Software](https://junglewise.ai/threats/technologies/appointment-booking-software) (OpenReception) | 14 | 3 | 3 | 0 | 9.9 |
| 8 | [Bouncy Castle for Java](https://junglewise.ai/threats/technologies/bouncy-castle-for-java) (Bouncy Castle) | 11 | 1 | 8 | 0 | 9.1 |
| 9 | [Pip Open-Webui](https://junglewise.ai/threats/technologies/open-webui) (Pip) | 17 | 0 | 6 | 0 | 8.7 |
| 10 | [Open62541 Project Open62541](https://junglewise.ai/threats/technologies/open62541) (Open62541 Project) | 10 | 0 | 8 | 0 | 7.5 |
| 11 | [SiYuan](https://junglewise.ai/threats/technologies/siyuan) (SiYuan) | 8 | 2 | 4 | 0 | 10 |
| 12 | [OpenSIPS](https://junglewise.ai/threats/technologies/opensips) (OpenSIPS) | 8 | 3 | 1 | 0 | 9.8 |
| 13 | [H3C NX15](https://junglewise.ai/threats/technologies/nx15) (H3C) | 8 | 0 | 8 | 0 | 7.3 |
| 14 | [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager) (Wso2) | 4 | 2 | 0 | 1 | 10 |
| 15 | [MSI Radix AXE6600](https://junglewise.ai/threats/technologies/radix-axe6600) (MSI) | 4 | 4 | 0 | 0 | 9.8 |
| 16 | [Bouncycastle Bouncy Castle For Java Lts](https://junglewise.ai/threats/technologies/bouncy-castle-for-java-lts) (Bouncycastle) | 8 | 1 | 5 | 0 | 9.1 |
| 17 | [Nvidia Dynamo for Linux](https://junglewise.ai/threats/technologies/dynamo-for-linux) (Nvidia) | 7 | 1 | 5 | 0 | 9.8 |
| 18 | [Wso2 API Control Plane](https://junglewise.ai/threats/technologies/api-control-plane) (Wso2) | 2 | 2 | 0 | 1 | 10 |
| 19 | [Wso2 Traffic Manager](https://junglewise.ai/threats/technologies/traffic-manager) (Wso2) | 2 | 2 | 0 | 1 | 10 |
| 20 | [Wso2 Universal Gateway](https://junglewise.ai/threats/technologies/universal-gateway) (Wso2) | 2 | 2 | 0 | 1 | 10 |
| 21 | [Gitpython Project Gitpython](https://junglewise.ai/threats/technologies/gitpython) (Gitpython Project) | 9 | 0 | 6 | 0 | 8.8 |
| 22 | [Cisco IOS XE](https://junglewise.ai/threats/technologies/ios-xe) (Cisco) | 6 | 1 | 5 | 0 | 9.8 |
| 23 | [Microsoft Edge Chromium](https://junglewise.ai/threats/technologies/edge-chromium) (Microsoft) | 11 | 0 | 4 | 0 | 8.1 |
| 24 | [Microsoft Edge](https://junglewise.ai/threats/technologies/edge-chromium-based) (Microsoft) | 11 | 0 | 4 | 0 | 8.1 |
| 25 | [Wso2 Enterprise Integrator](https://junglewise.ai/threats/technologies/enterprise-integrator) (Wso2) | 3 | 1 | 0 | 1 | 10 |

## Most affected vendors

1. [Npm](https://junglewise.ai/threats/vendors/npm): 57 vulnerabilities, 14 critical, 0 exploited
2. [D-Link](https://junglewise.ai/threats/vendors/d-link): 15 vulnerabilities, 15 critical, 0 exploited
3. [Pip](https://junglewise.ai/threats/vendors/pypi): 35 vulnerabilities, 0 critical, 0 exploited
4. [Go](https://junglewise.ai/threats/vendors/go): 24 vulnerabilities, 3 critical, 0 exploited
5. [Linux](https://junglewise.ai/threats/vendors/linux): 19 vulnerabilities, 2 critical, 0 exploited
6. [Progress](https://junglewise.ai/threats/vendors/progress): 10 vulnerabilities, 7 critical, 0 exploited
7. [Cisco](https://junglewise.ai/threats/vendors/cisco): 15 vulnerabilities, 2 critical, 0 exploited
8. [Nvidia](https://junglewise.ai/threats/vendors/nvidia): 16 vulnerabilities, 1 critical, 0 exploited
9. [OpenReception](https://junglewise.ai/threats/vendors/openreception): 15 vulnerabilities, 4 critical, 0 exploited
10. [Bouncy Castle](https://junglewise.ai/threats/vendors/bouncy-castle): 13 vulnerabilities, 2 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-5430: The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported…](https://junglewise.ai/threats/cve-2026-5430-wso2-api-control-plane-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 10, published 6 Aug 2026)
- [CVE-2026-65400: An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS…](https://junglewise.ai/threats/cve-2026-65400-apple-macos-screen-sharing-authentication-bypass) (critical, exploited in the wild, CVSS 9.8, published 6 Aug 2026)
- [CVE-2026-70478: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST…](https://junglewise.ai/threats/cve-2026-70478-flowise-unauthenticated-oauth2-token-refresh-in-credential) (critical, CVSS 10, published 4 Aug 2026)
- [SiYuan SQL injection in fullTextSearchAssetContent endpoint](https://junglewise.ai/threats/siyuan-sql-injection-in-fulltextsearchassetcontent-endpoint-77bd29ce) (critical, CVSS 10, published 3 Aug 2026)
- [SiYuan searchEmbedBlock SQL injection](https://junglewise.ai/threats/siyuan-searchembedblock-sql-injection-1301810a) (critical, CVSS 10, published 3 Aug 2026)
- [CVE-2026-7329: Progress MarkLogic Server privilege escalation in query interfaces](https://junglewise.ai/threats/cve-2026-7329-progress-marklogic-server-privilege-escalation-in-query-interfaces) (critical, CVSS 9.9, published 5 Aug 2026)
- [CVE-2026-9193: Progress MarkLogic Server privilege escalation in Hadoop integration](https://junglewise.ai/threats/cve-2026-9193-progress-marklogic-server-privilege-escalation-in-hadoop) (critical, CVSS 9.9, published 5 Aug 2026)
- [CVE-2026-8709: Progress MarkLogic Server REST API privilege escalation in document patch](https://junglewise.ai/threats/cve-2026-8709-progress-marklogic-server-rest-api-privilege-escalation-in) (critical, CVSS 9.9, published 5 Aug 2026)
- [CVE-2026-48086: OpenReception privilege escalation in role-update handler](https://junglewise.ai/threats/cve-2026-48086-openreception-privilege-escalation-in-role-update-handler) (critical, CVSS 9.9, published 6 Aug 2026)
- [CVE-2026-18616: GL-iNet GL-MT3000 command injection in wg-server](https://junglewise.ai/threats/cve-2026-18616-gl-inet-gl-mt3000-command-injection-in-wg-server) (critical, CVSS 9.8, published 3 Aug 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 3 to 9 August 2026 (week 32)", https://junglewise.ai/threats/weekly/2026-08-03, 26 September 2026.