# Most vulnerable technologies: week of 7 to 13 September 2026 (week 37)

Source: https://junglewise.ai/threats/weekly/2026-09-07  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 09:11 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-09-07.json  
License: CC BY 4.0 with a link back

In the week of 7 to 13 September 2026, Junglewise Threat Intelligence recorded 3,792 new vulnerabilities: 319 critical, 1,701 high and 9 exploited in the wild. The most vulnerable technology was Linux Kernel, with 420 vulnerabilities (66 critical), followed by Microsoft Windows  (399) and Google Chrome (227).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 420 | 66 | 195 | 0 | 9.8 |
| 2 | [Microsoft Windows ](https://junglewise.ai/threats/technologies/windows-) (Microsoft) | 399 | 17 | 295 | 2 | 9.8 |
| 3 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 227 | 34 | 51 | 1 | 9.8 |
| 4 | [Google Android](https://junglewise.ai/threats/technologies/android) (Google) | 103 | 8 | 59 | 0 | 9.8 |
| 5 | [Microsoft SQL Server](https://junglewise.ai/threats/technologies/sql-server) (Microsoft) | 60 | 5 | 31 | 0 | 9.8 |
| 6 | [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo) (WWBN) | 61 | 1 | 27 | 0 | 9.3 |
| 7 | [Dell Secure Connect Gateway Appliance](https://junglewise.ai/threats/technologies/secure-connect-gateway-appliance) (Dell) | 56 | 2 | 17 | 0 | 9.4 |
| 8 | [Dell Secure Connect Gateway Application](https://junglewise.ai/threats/technologies/secure-connect-gateway-application) (Dell) | 56 | 2 | 17 | 0 | 9.4 |
| 9 | [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe) (Apple) | 40 | 4 | 20 | 0 | 9.6 |
| 10 | [Microsoft Windows Biometric Service](https://junglewise.ai/threats/technologies/windows-biometric-service) (Microsoft) | 34 | 0 | 33 | 0 | 8 |
| 11 | [Microsoft Office Word](https://junglewise.ai/threats/technologies/office-word) (Microsoft) | 35 | 0 | 21 | 0 | 8.8 |
| 12 | [Dell Secure Connect Gateway 5.0 Appliance](https://junglewise.ai/threats/technologies/secure-connect-gateway-5-0-appliance) (Dell) | 40 | 1 | 14 | 0 | 9.8 |
| 13 | [Dell Secure Connect Gateway 5.0 Application](https://junglewise.ai/threats/technologies/secure-connect-gateway-5-0-application) (Dell) | 40 | 1 | 14 | 0 | 9.8 |
| 14 | [Adobe Acrobat](https://junglewise.ai/threats/technologies/acrobat) (Adobe) | 31 | 0 | 20 | 0 | 8.8 |
| 15 | [Adobe Acrobat DC](https://junglewise.ai/threats/technologies/acrobat-dc) (Adobe) | 31 | 0 | 20 | 0 | 8.8 |
| 16 | [Adobe Acrobat Reader](https://junglewise.ai/threats/technologies/acrobat-reader) (Adobe) | 31 | 0 | 20 | 0 | 8.8 |
| 17 | [Adobe Acrobat Reader DC](https://junglewise.ai/threats/technologies/acrobat-reader-dc) (Adobe) | 31 | 0 | 20 | 0 | 8.8 |
| 18 | [Microsoft Windows DHCP Server](https://junglewise.ai/threats/technologies/windows-dhcp-server) (Microsoft) | 28 | 2 | 15 | 0 | 9.8 |
| 19 | [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it) (Snipeitapp) | 43 | 0 | 10 | 0 | 8.7 |
| 20 | [IBM Datastage On Cloud Pak For Data](https://junglewise.ai/threats/technologies/datastage-on-cloud-pak-for-data) (IBM) | 18 | 3 | 15 | 0 | 9.6 |
| 21 | [Amazon AWS](https://junglewise.ai/threats/technologies/aws) (Amazon) | 18 | 2 | 16 | 0 | 9.9 |
| 22 | [Geovision GV-LPC2211](https://junglewise.ai/threats/technologies/gv-lpc2211) (Geovision) | 23 | 2 | 12 | 0 | 9.8 |
| 23 | [Langflow](https://junglewise.ai/threats/technologies/langflow) (Langflow) | 18 | 3 | 12 | 0 | 9.8 |
| 24 | [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss) (IBM) | 18 | 3 | 12 | 0 | 9.8 |
| 25 | [Knowns-Dev Knowns](https://junglewise.ai/threats/technologies/knowns) (Knowns-Dev) | 16 | 4 | 10 | 0 | 9.8 |

## Most affected vendors

1. [Microsoft](https://junglewise.ai/threats/vendors/microsoft): 980 vulnerabilities, 49 critical, 3 exploited
2. [Linux](https://junglewise.ai/threats/vendors/linux): 420 vulnerabilities, 66 critical, 0 exploited
3. [Google](https://junglewise.ai/threats/vendors/google): 321 vulnerabilities, 37 critical, 1 exploited
4. [Dell](https://junglewise.ai/threats/vendors/dell): 115 vulnerabilities, 7 critical, 0 exploited
5. [Adobe](https://junglewise.ai/threats/vendors/adobe): 61 vulnerabilities, 6 critical, 1 exploited
6. [IBM](https://junglewise.ai/threats/vendors/ibm): 51 vulnerabilities, 8 critical, 0 exploited
7. [WWBN](https://junglewise.ai/threats/vendors/wwbn): 61 vulnerabilities, 1 critical, 0 exploited
8. [Apple](https://junglewise.ai/threats/vendors/apple): 45 vulnerabilities, 5 critical, 0 exploited
9. [Go](https://junglewise.ai/threats/vendors/go): 33 vulnerabilities, 5 critical, 0 exploited
10. [Amazon](https://junglewise.ai/threats/vendors/amazon): 19 vulnerabilities, 3 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1…](https://junglewise.ai/threats/cve-2026-85706-gitlab-community-and-enterprise-edition-path-traversal-in-commits) (critical, exploited in the wild, CVSS 10, published 12 Sep 2026)
- [CVE-2026-75650: Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that…](https://junglewise.ai/threats/cve-2026-75650-adobe-commerce-and-magento-improper-neutralization-in-template) (critical, exploited in the wild, CVSS 10, published 7 Sep 2026)
- [CVE-2026-84869: A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session…](https://junglewise.ai/threats/cve-2026-84869-connectwise-screenconnect-unauthorized-file-transfer-and) (critical, exploited in the wild, CVSS 9.9, published 8 Sep 2026)
- [CVE-2026-19490: Citrix NetScaler authentication bypass via alternate path](https://junglewise.ai/threats/cve-2026-19490-citrix-netscaler-authentication-bypass-via-alternate-path) (critical, exploited in the wild, CVSS 9.8, published 9 Sep 2026)
- [CVE-2026-85102: Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an…](https://junglewise.ai/threats/cve-2026-85102-check-point-security-gateway-and-spark-firewall-improper) (critical, exploited in the wild, CVSS 9.8, published 9 Sep 2026)
- [CVE-2026-87491: Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code…](https://junglewise.ai/threats/cve-2026-87491-google-chromium-v8-out-of-bounds-write-in-javascript-engine) (critical, exploited in the wild, CVSS 8.8, published 9 Sep 2026)
- [CVE-2026-85880: Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.](https://junglewise.ai/threats/cve-2026-85880-microsoft-windows-heap-based-buffer-overflow-in-advanced-local) (critical, exploited in the wild, CVSS 7.8, published 8 Sep 2026)
- [CVE-2026-81963: Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to…](https://junglewise.ai/threats/cve-2026-81963-microsoft-windows-privilege-escalation-via-link-following-in) (critical, exploited in the wild, CVSS 7.8, published 8 Sep 2026)
- [CVE-2026-42018: JFrog Artifactory improper authentication vulnerability](https://junglewise.ai/threats/cve-2026-42018-jfrog-artifactory-improper-authentication-vulnerability) (critical, exploited in the wild, published 11 Sep 2026)
- [CVE-2026-82004: Adobe Campaign Classic OS command injection](https://junglewise.ai/threats/cve-2026-82004-adobe-campaign-classic-os-command-injection) (critical, CVSS 10, published 8 Sep 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 7 to 13 September 2026 (week 37)", https://junglewise.ai/threats/weekly/2026-09-07, 26 September 2026.