# Most vulnerable technologies: week of 24 to 30 August 2026 (week 35)

Source: https://junglewise.ai/threats/weekly/2026-08-24  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 09:11 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-08-24.json  
License: CC BY 4.0 with a link back

In the week of 24 to 30 August 2026, Junglewise Threat Intelligence recorded 2,819 new vulnerabilities: 331 critical, 968 high and 10 exploited in the wild. The most vulnerable technology was Google Chrome, with 327 vulnerabilities (44 critical), followed by Linux Kernel (249) and Pip Nltk (33).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 327 | 44 | 77 | 0 | 9.8 |
| 2 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 249 | 41 | 118 | 1 | 10 |
| 3 | [Pip Nltk](https://junglewise.ai/threats/technologies/nltk) (Pip) | 33 | 6 | 18 | 0 | 9.8 |
| 4 | [DrayTek VigorSwitch FX2120](https://junglewise.ai/threats/technologies/vigorswitch-fx2120) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 5 | [DrayTek VigorSwitch G1280](https://junglewise.ai/threats/technologies/vigorswitch-g1280) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 6 | [DrayTek VigorSwitch G1282](https://junglewise.ai/threats/technologies/vigorswitch-g1282) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 7 | [DrayTek VigorSwitch G2100](https://junglewise.ai/threats/technologies/vigorswitch-g2100) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 8 | [DrayTek VigorSwitch G2121](https://junglewise.ai/threats/technologies/vigorswitch-g2121) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 9 | [DrayTek VigorSwitch G2280x](https://junglewise.ai/threats/technologies/vigorswitch-g2280x) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 10 | [DrayTek VigorSwitch G2282x](https://junglewise.ai/threats/technologies/vigorswitch-g2282x) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 11 | [DrayTek VigorSwitch G2540x](https://junglewise.ai/threats/technologies/vigorswitch-g2540x) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 12 | [DrayTek VigorSwitch G2540xs](https://junglewise.ai/threats/technologies/vigorswitch-g2540xs) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 13 | [DrayTek VigorSwitch G2542x](https://junglewise.ai/threats/technologies/vigorswitch-g2542x) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 14 | [DrayTek VigorSwitch P1280](https://junglewise.ai/threats/technologies/vigorswitch-p1280) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 15 | [DrayTek VigorSwitch P1281x](https://junglewise.ai/threats/technologies/vigorswitch-p1281x) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 16 | [DrayTek VigorSwitch P1282](https://junglewise.ai/threats/technologies/vigorswitch-p1282) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 17 | [DrayTek VigorSwitch P2100](https://junglewise.ai/threats/technologies/vigorswitch-p2100) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 18 | [DrayTek VigorSwitch P2121](https://junglewise.ai/threats/technologies/vigorswitch-p2121) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 19 | [DrayTek VigorSwitch P2280x](https://junglewise.ai/threats/technologies/vigorswitch-p2280x) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 20 | [DrayTek VigorSwitch P2282x](https://junglewise.ai/threats/technologies/vigorswitch-p2282x) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 21 | [DrayTek VigorSwitch P2540x](https://junglewise.ai/threats/technologies/vigorswitch-p2540x) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 22 | [DrayTek VigorSwitch P2540xs](https://junglewise.ai/threats/technologies/vigorswitch-p2540xs) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 23 | [DrayTek VigorSwitch P2542x](https://junglewise.ai/threats/technologies/vigorswitch-p2542x) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 24 | [DrayTek VigorSwitch P2542xh](https://junglewise.ai/threats/technologies/vigorswitch-p2542xh) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |
| 25 | [DrayTek VigorSwitch PQ2121x](https://junglewise.ai/threats/technologies/vigorswitch-pq2121x) (DrayTek) | 29 | 2 | 25 | 0 | 9.8 |

## Most affected vendors

1. [Google](https://junglewise.ai/threats/vendors/google): 333 vulnerabilities, 44 critical, 0 exploited
2. [Linux](https://junglewise.ai/threats/vendors/linux): 249 vulnerabilities, 41 critical, 1 exploited
3. [Pip](https://junglewise.ai/threats/vendors/pypi): 51 vulnerabilities, 10 critical, 0 exploited
4. [Ubiquiti](https://junglewise.ai/threats/vendors/ubiquiti): 22 vulnerabilities, 22 critical, 0 exploited
5. [DrayTek](https://junglewise.ai/threats/vendors/draytek): 40 vulnerabilities, 3 critical, 0 exploited
6. [Adobe](https://junglewise.ai/threats/vendors/adobe): 41 vulnerabilities, 3 critical, 0 exploited
7. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 35 vulnerabilities, 7 critical, 1 exploited
8. [Go](https://junglewise.ai/threats/vendors/go): 37 vulnerabilities, 5 critical, 1 exploited
9. [Jahlives](https://junglewise.ai/threats/vendors/jahlives): 34 vulnerabilities, 4 critical, 0 exploited
10. [Apache](https://junglewise.ai/threats/vendors/apache): 24 vulnerabilities, 7 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2021-23758: Ajax.NET Professional unsafe deserialization of untrusted data](https://junglewise.ai/threats/cve-2021-23758-ajax-net-professional-unsafe-deserialization-of-untrusted-data) (critical, exploited in the wild, CVSS 9.8, published 26 Aug 2026)
- [CVE-2026-60004: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.](https://junglewise.ai/threats/cve-2026-60004-gitea-code-injection-in-diffpatch-api) (critical, exploited in the wild, CVSS 9.8, published 26 Aug 2026)
- [CVE-2026-82329: JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated…](https://junglewise.ai/threats/cve-2026-82329-jfrog-artifactory-improper-authentication-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 28 Aug 2026)
- [CVE-2026-81578: An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under…](https://junglewise.ai/threats/cve-2026-81578-papercut-ng-mf-missing-authentication-for-critical-function) (critical, exploited in the wild, CVSS 9.8, published 28 Aug 2026)
- [CVE-2026-82078: An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG…](https://junglewise.ai/threats/cve-2026-82078-papercut-ng-mf-unsafe-reflection-vulnerability) (critical, exploited in the wild, CVSS 9.1, published 28 Aug 2026)
- [CVE-2015-5287: Red Hat ABRT privilege escalation via symlink attack](https://junglewise.ai/threats/cve-2015-5287-red-hat-abrt-privilege-escalation-via-symlink-attack) (critical, exploited in the wild, CVSS 7, published 26 Aug 2026)
- [CVE-2019-1068: Microsoft SQL Server remote code execution](https://junglewise.ai/threats/cve-2019-1068-microsoft-sql-server-remote-code-execution) (critical, exploited in the wild, published 26 Aug 2026)
- [CVE-2023-49105: ownCloud improper authentication vulnerability](https://junglewise.ai/threats/cve-2023-49105-owncloud-improper-authentication-vulnerability) (critical, exploited in the wild, published 27 Aug 2026)
- [CVE-2015-3246: Red Hat Libuser race condition in passwd file handling](https://junglewise.ai/threats/cve-2015-3246-red-hat-libuser-race-condition-in-passwd-file-handling) (critical, exploited in the wild, published 26 Aug 2026)
- [CVE-2022-0995: Linux Kernel out-of-bounds write vulnerability](https://junglewise.ai/threats/cve-2022-0995-linux-kernel-out-of-bounds-write-vulnerability) (critical, exploited in the wild, published 26 Aug 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 24 to 30 August 2026 (week 35)", https://junglewise.ai/threats/weekly/2026-08-24, 26 September 2026.