# Most vulnerable technologies: week of 17 to 23 August 2026 (week 34)

Source: https://junglewise.ai/threats/weekly/2026-08-17  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 09:24 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-08-17.json  
License: CC BY 4.0 with a link back

In the week of 17 to 23 August 2026, Junglewise Threat Intelligence recorded 2,072 new vulnerabilities: 270 critical, 829 high and 4 exploited in the wild. The most vulnerable technology was Linux Kernel, with 158 vulnerabilities (22 critical), followed by IBM AIX (72) and IBM PowerVM VIOS (72).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 158 | 22 | 85 | 0 | 10 |
| 2 | [IBM AIX](https://junglewise.ai/threats/technologies/aix) (IBM) | 72 | 12 | 42 | 0 | 9.9 |
| 3 | [IBM PowerVM VIOS](https://junglewise.ai/threats/technologies/powervm-vios) (IBM) | 72 | 12 | 42 | 0 | 9.9 |
| 4 | [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird) (Mozilla) | 52 | 15 | 25 | 0 | 10 |
| 5 | [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox) (Mozilla) | 52 | 14 | 25 | 0 | 10 |
| 6 | [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr) (Mozilla) | 49 | 12 | 25 | 0 | 10 |
| 7 | [Oracle Helidon](https://junglewise.ai/threats/technologies/helidon) (Oracle) | 55 | 6 | 19 | 0 | 9.8 |
| 8 | [Oracle Hyperion Data Relationship Management](https://junglewise.ai/threats/technologies/hyperion-data-relationship-management) (Oracle) | 35 | 7 | 26 | 0 | 10 |
| 9 | [Oracle Commerce Experience Manager](https://junglewise.ai/threats/technologies/commerce-experience-manager) (Oracle) | 40 | 7 | 21 | 0 | 9.3 |
| 10 | [Oracle Commerce Guided Search](https://junglewise.ai/threats/technologies/commerce-guided-search) (Oracle) | 40 | 7 | 21 | 0 | 9.3 |
| 11 | [Oracle Hyperion Financial Management](https://junglewise.ai/threats/technologies/hyperion-financial-management) (Oracle) | 49 | 3 | 18 | 0 | 10 |
| 12 | [Npm Orval](https://junglewise.ai/threats/technologies/orval) (Npm) | 12 | 11 | 1 | 0 | 7.1 |
| 13 | [Apache CloudStack](https://junglewise.ai/threats/technologies/cloudstack) (Apache) | 20 | 3 | 12 | 0 | 9.1 |
| 14 | [Go Github.com/Lxc/Incus/V7/Cmd/Incusd](https://junglewise.ai/threats/technologies/github-com-lxc-incus-v7-cmd-incusd) (Go) | 10 | 7 | 1 | 0 | 9.9 |
| 15 | [Pip Nltk](https://junglewise.ai/threats/technologies/nltk) (Pip) | 22 | 0 | 11 | 0 | 8.8 |
| 16 | [Combodo iTop](https://junglewise.ai/threats/technologies/itop) (Combodo) | 18 | 0 | 13 | 0 | 8.8 |
| 17 | [Mozilla Thunderbird-Esr](https://junglewise.ai/threats/technologies/thunderbird-esr) (Mozilla) | 12 | 4 | 6 | 0 | 10 |
| 18 | [N8n](https://junglewise.ai/threats/technologies/n8n) (N8n) | 17 | 2 | 8 | 0 | 9.8 |
| 19 | [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb) (ArcadeData) | 13 | 4 | 5 | 0 | 9.9 |
| 20 | [IBM Power Systems Firmware](https://junglewise.ai/threats/technologies/power-systems-firmware) (IBM) | 12 | 2 | 9 | 0 | 9.6 |
| 21 | [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe) (Apple) | 31 | 0 | 4 | 0 | 8.8 |
| 22 | [Oracle VirtualBox](https://junglewise.ai/threats/technologies/virtualbox) (Oracle) | 21 | 0 | 9 | 0 | 8.6 |
| 23 | [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados) (Apple) | 30 | 0 | 3 | 0 | 8.8 |
| 24 | [NLTK Project Natural Language Toolkit](https://junglewise.ai/threats/technologies/natural-language-toolkit) (NLTK Project) | 19 | 0 | 8 | 0 | 8.8 |
| 25 | [Pip Justhtml](https://junglewise.ai/threats/technologies/justhtml) (Pip) | 12 | 3 | 3 | 0 | 9.8 |

## Most affected vendors

1. [Oracle](https://junglewise.ai/threats/vendors/oracle): 294 vulnerabilities, 31 critical, 0 exploited
2. [Linux](https://junglewise.ai/threats/vendors/linux): 158 vulnerabilities, 22 critical, 0 exploited
3. [IBM](https://junglewise.ai/threats/vendors/ibm): 86 vulnerabilities, 14 critical, 0 exploited
4. [Pip](https://junglewise.ai/threats/vendors/pypi): 90 vulnerabilities, 5 critical, 1 exploited
5. [Mozilla](https://junglewise.ai/threats/vendors/mozilla): 55 vulnerabilities, 15 critical, 0 exploited
6. [Npm](https://junglewise.ai/threats/vendors/npm): 56 vulnerabilities, 15 critical, 0 exploited
7. [Go](https://junglewise.ai/threats/vendors/go): 49 vulnerabilities, 10 critical, 0 exploited
8. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 23 vulnerabilities, 12 critical, 0 exploited
9. [Apache](https://junglewise.ai/threats/vendors/apache): 31 vulnerabilities, 6 critical, 0 exploited
10. [Splunk](https://junglewise.ai/threats/vendors/splunk): 50 vulnerabilities, 1 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-73570: Zimbra Collaboration Suite OS command injection in SMTP](https://junglewise.ai/threats/cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp) (critical, exploited in the wild, CVSS 9.8, published 21 Aug 2026)
- [CVE-2026-72529: A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X…](https://junglewise.ai/threats/cve-2026-72529-trueconf-server-missing-authentication-for-critical-function) (critical, exploited in the wild, CVSS 9.8, published 19 Aug 2026)
- [CVE-2026-64849: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to…](https://junglewise.ai/threats/cve-2026-64849-mlflow-server-side-request-forgery) (critical, exploited in the wild, CVSS 9.3, published 17 Aug 2026)
- [CVE-2026-72530: A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X…](https://junglewise.ai/threats/cve-2026-72530-trueconf-server-code-injection-vulnerability) (critical, exploited in the wild, CVSS 9, published 19 Aug 2026)
- [CVE-2026-69836: Microsoft Entra ID deserialization of untrusted data remote code execution](https://junglewise.ai/threats/cve-2026-69836-microsoft-entra-id-deserialization-of-untrusted-data-remote-code) (critical, CVSS 10, published 20 Aug 2026)
- [CVE-2026-19977: EFM ipTIME A3004T authentication bypass in session validation](https://junglewise.ai/threats/cve-2026-19977-efm-iptime-a3004t-authentication-bypass-in-session-validation) (critical, CVSS 10, published 17 Aug 2026)
- [CVE-2026-61539: Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference…](https://junglewise.ai/threats/cve-2026-61539-xinference-remote-code-execution-via-unsafe-eval-in-llama3-tool) (critical, CVSS 10, published 21 Aug 2026)
- [CVE-2026-65770: Microsoft Azure Managed Instance for Apache Cassandra argument injection](https://junglewise.ai/threats/cve-2026-65770-microsoft-azure-managed-instance-for-apache-cassandra-argument) (critical, CVSS 10, published 20 Aug 2026)
- [CVE-2026-77946: TRENDnet TEW-821DAP stack-based buffer overflow in NTP timezone configuration](https://junglewise.ai/threats/cve-2026-77946-trendnet-tew-821dap-stack-based-buffer-overflow-in-ntp-timezone) (critical, CVSS 10, published 22 Aug 2026)
- [CVE-2026-65816: Microsoft Azure Arc name resolution privilege escalation](https://junglewise.ai/threats/cve-2026-65816-microsoft-azure-arc-name-resolution-privilege-escalation) (critical, CVSS 10, published 20 Aug 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 17 to 23 August 2026 (week 34)", https://junglewise.ai/threats/weekly/2026-08-17, 26 September 2026.