# Most vulnerable technologies: week of 31 August to 6 September 2026 (week 36)

Source: https://junglewise.ai/threats/weekly/2026-08-31  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 09:11 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-08-31.json  
License: CC BY 4.0 with a link back

In the week of 31 August to 6 September 2026, Junglewise Threat Intelligence recorded 2,379 new vulnerabilities: 294 critical, 771 high and 7 exploited in the wild. The most vulnerable technology was Linux Kernel, with 204 vulnerabilities (1 critical), followed by Google Chrome (37) and Arubanetworks Fabric Composer (51).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 204 | 1 | 22 | 0 | 9.3 |
| 2 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 37 | 11 | 12 | 1 | 9.8 |
| 3 | [Arubanetworks Fabric Composer](https://junglewise.ai/threats/technologies/fabric-composer) (Arubanetworks) | 51 | 5 | 23 | 0 | 10 |
| 4 | [Hpe Networking Fabric Composer](https://junglewise.ai/threats/technologies/networking-fabric-composer) (Hpe) | 51 | 5 | 23 | 0 | 10 |
| 5 | [SiYuan](https://junglewise.ai/threats/technologies/siyuan) (SiYuan) | 43 | 4 | 19 | 0 | 10 |
| 6 | [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird) (Mozilla) | 30 | 10 | 10 | 0 | 9.8 |
| 7 | [Nvidia Megatron-Bridge](https://junglewise.ai/threats/technologies/megatron-bridge) (Nvidia) | 30 | 0 | 30 | 0 | 7.8 |
| 8 | [Nvidia NeMo Megatron Bridge](https://junglewise.ai/threats/technologies/nemo-megatron-bridge) (Nvidia) | 30 | 0 | 30 | 0 | 7.8 |
| 9 | [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox) (Mozilla) | 24 | 8 | 6 | 0 | 9.8 |
| 10 | [Go Github.com/Siyuan-Note/Siyuan/Kernel](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel) (Go) | 30 | 3 | 14 | 0 | 10 |
| 11 | [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo) (WWBN) | 27 | 5 | 10 | 0 | 9.8 |
| 12 | [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr) (Mozilla) | 19 | 7 | 4 | 0 | 9.8 |
| 13 | [MikroTik RouterOS](https://junglewise.ai/threats/technologies/routeros) (MikroTik) | 3 | 3 | 0 | 3 | 9.8 |
| 14 | [D-Link DNS-340L](https://junglewise.ai/threats/technologies/dns-340l) (D-Link) | 7 | 7 | 0 | 0 | 9.9 |
| 15 | [Npm @Xmldom/Xmldom](https://junglewise.ai/threats/technologies/xmldom-xmldom) (Npm) | 15 | 0 | 13 | 0 | 4 |
| 16 | [MOOS Core-Moos](https://junglewise.ai/threats/technologies/core-moos) (MOOS) | 12 | 3 | 7 | 0 | 9.8 |
| 17 | [Elastic Kibana](https://junglewise.ai/threats/technologies/kibana) (Elastic) | 30 | 0 | 5 | 0 | 8.3 |
| 18 | [Dell PowerStore](https://junglewise.ai/threats/technologies/powerstore) (Dell) | 13 | 1 | 11 | 0 | 9.8 |
| 19 | [Microsoft Windows ](https://junglewise.ai/threats/technologies/windows-) (Microsoft) | 20 | 0 | 8 | 0 | 8.8 |
| 20 | [YesWiki](https://junglewise.ai/threats/technologies/yeswiki) (YesWiki) | 12 | 2 | 6 | 0 | 9.4 |
| 21 | [Composer Yeswiki/Yeswiki](https://junglewise.ai/threats/technologies/yeswiki-yeswiki) (Composer) | 12 | 2 | 6 | 0 | 9.4 |
| 22 | [Mozilla Thunderbird-Esr](https://junglewise.ai/threats/technologies/thunderbird-esr) (Mozilla) | 11 | 3 | 4 | 0 | 9.8 |
| 23 | [Haxx Curl](https://junglewise.ai/threats/technologies/curl) (Haxx) | 9 | 2 | 7 | 0 | 9.8 |
| 24 | [Sitecore CMS](https://junglewise.ai/threats/technologies/cms) (Sitecore) | 15 | 1 | 6 | 0 | 9.8 |
| 25 | SonicWall SMA1000 (SonicWall) | 2 | 2 | 0 | 2 | 10 |

## Most affected vendors

1. [Linux](https://junglewise.ai/threats/vendors/linux): 204 vulnerabilities, 1 critical, 0 exploited
2. [Go](https://junglewise.ai/threats/vendors/go): 53 vulnerabilities, 7 critical, 0 exploited
3. [Google](https://junglewise.ai/threats/vendors/google): 41 vulnerabilities, 11 critical, 1 exploited
4. [Hpe](https://junglewise.ai/threats/vendors/hpe): 53 vulnerabilities, 5 critical, 0 exploited
5. [Npm](https://junglewise.ai/threats/vendors/npm): 58 vulnerabilities, 5 critical, 0 exploited
6. [Arubanetworks](https://junglewise.ai/threats/vendors/arubanetworks): 51 vulnerabilities, 5 critical, 0 exploited
7. [IBM](https://junglewise.ai/threats/vendors/ibm): 70 vulnerabilities, 2 critical, 0 exploited
8. [Mozilla](https://junglewise.ai/threats/vendors/mozilla): 34 vulnerabilities, 11 critical, 0 exploited
9. [SiYuan](https://junglewise.ai/threats/vendors/siyuan): 40 vulnerabilities, 4 critical, 0 exploited
10. [Nvidia](https://junglewise.ai/threats/vendors/nvidia): 30 vulnerabilities, 0 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-83548: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended…](https://junglewise.ai/threats/cve-2026-83548-sonicwall-sma1000-server-side-request-forgery) (critical, exploited in the wild, CVSS 10, published 1 Sep 2026)
- [CVE-2026-86218: N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.](https://junglewise.ai/threats/cve-2026-86218-n-able-n-central-static-code-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 6 Sep 2026)
- [CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited…](https://junglewise.ai/threats/cve-2026-86060-mikrotik-routeros-argument-delimiter-neutralization-privilege) (critical, exploited in the wild, CVSS 9.8, published 5 Sep 2026)
- [CVE-2026-85046: Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside…](https://junglewise.ai/threats/cve-2026-85046-google-chromium-v8-type-confusion-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 3 Sep 2026)
- [CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An…](https://junglewise.ai/threats/cve-2026-67277-mikrotik-routeros-missing-authentication-in-btest-service) (critical, exploited in the wild, CVSS 8.2, published 5 Sep 2026)
- [CVE-2026-83549: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')…](https://junglewise.ai/threats/cve-2026-83549-sonicwall-sma1000-os-command-injection) (critical, exploited in the wild, CVSS 7.8, published 1 Sep 2026)
- [CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never…](https://junglewise.ai/threats/cve-2026-67279-mikrotik-routeros-improper-behavioral-workflow-enforcement) (critical, exploited in the wild, CVSS 6.5, published 5 Sep 2026)
- [CVE-2026-82971: QVidium Opera11 command injection in net_tr.cgi](https://junglewise.ai/threats/cve-2026-82971-qvidium-opera11-command-injection-in-net-tr-cgi) (critical, CVSS 10, published 31 Aug 2026)
- [CVE-2026-86152: Tenda CP3 OS command injection in AutoAddWifi](https://junglewise.ai/threats/cve-2026-86152-tenda-cp3-os-command-injection-in-autoaddwifi) (critical, CVSS 10, published 6 Sep 2026)
- [CVE-2026-69084: SiYuan arbitrary SQL execution via searchEmbedBlock](https://junglewise.ai/threats/cve-2026-69084-siyuan-arbitrary-sql-execution-via-searchembedblock) (critical, CVSS 10, published 3 Sep 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 31 August to 6 September 2026 (week 36)", https://junglewise.ai/threats/weekly/2026-08-31, 26 September 2026.