# Most vulnerable technologies: week of 14 to 20 September 2026 (week 38)

Source: https://junglewise.ai/threats/weekly/2026-09-14  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 26 September 2026, 09:11 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-09-14.json  
License: CC BY 4.0 with a link back

In the week of 14 to 20 September 2026, Junglewise Threat Intelligence recorded 4,840 new vulnerabilities: 468 critical, 1,946 high and 4 exploited in the wild. The most vulnerable technology was Linux Kernel, with 867 vulnerabilities (32 critical), followed by Apple macOS (221) and Apple macOS Golden Gate (172).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 867 | 32 | 279 | 0 | 9.8 |
| 2 | [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe) (Apple) | 221 | 8 | 72 | 0 | 10 |
| 3 | [Apple macOS Golden Gate](https://junglewise.ai/threats/technologies/macos-golden-gate) (Apple) | 172 | 8 | 54 | 0 | 10 |
| 4 | [Oracle Hyperion Financial Management](https://junglewise.ai/threats/technologies/hyperion-financial-management) (Oracle) | 80 | 13 | 66 | 0 | 10 |
| 5 | [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird) (Mozilla) | 76 | 21 | 45 | 0 | 9.8 |
| 6 | [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox) (Mozilla) | 72 | 19 | 43 | 0 | 9.8 |
| 7 | [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados) (Apple) | 139 | 5 | 37 | 0 | 9.8 |
| 8 | [Google Android](https://junglewise.ai/threats/technologies/android) (Google) | 97 | 5 | 44 | 1 | 9.8 |
| 9 | [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr) (Mozilla) | 64 | 12 | 43 | 0 | 9.6 |
| 10 | [Apple visionOS](https://junglewise.ai/threats/technologies/visionos) (Apple) | 97 | 5 | 25 | 0 | 9.8 |
| 11 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 57 | 10 | 24 | 0 | 9.6 |
| 12 | [Apple watchOS](https://junglewise.ai/threats/technologies/watchos) (Apple) | 82 | 5 | 21 | 0 | 9.8 |
| 13 | [Npm Vm2](https://junglewise.ai/threats/technologies/vm2) (Npm) | 34 | 20 | 7 | 0 | 10 |
| 14 | [Apple tvOS](https://junglewise.ai/threats/technologies/tvos) (Apple) | 78 | 4 | 22 | 0 | 9.8 |
| 15 | [Oracle E-Business Suite](https://junglewise.ai/threats/technologies/e-business-suite) (Oracle) | 42 | 1 | 39 | 0 | 9.8 |
| 16 | [Cisco Identity Services Engine](https://junglewise.ai/threats/technologies/identity-services-engine) (Cisco) | 38 | 12 | 5 | 1 | 10 |
| 17 | [Apple Iphone Os](https://junglewise.ai/threats/technologies/iphone-os) (Apple) | 64 | 1 | 19 | 0 | 9.1 |
| 18 | [Oracle WebCenter Portal](https://junglewise.ai/threats/technologies/webcenter-portal) (Oracle) | 24 | 10 | 14 | 0 | 9.9 |
| 19 | [Oracle Business Intelligence Enterprise Edition](https://junglewise.ai/threats/technologies/business-intelligence-enterprise-edition) (Oracle) | 29 | 2 | 27 | 0 | 9.9 |
| 20 | [Oracle Siebel CRM](https://junglewise.ai/threats/technologies/siebel-crm) (Oracle) | 27 | 4 | 21 | 0 | 9.1 |
| 21 | [Arista EOS](https://junglewise.ai/threats/technologies/eos) (Arista) | 41 | 4 | 10 | 0 | 10 |
| 22 | [Oracle Commerce Experience Manager](https://junglewise.ai/threats/technologies/commerce-experience-manager) (Oracle) | 26 | 0 | 24 | 0 | 8.2 |
| 23 | [Oracle Access Manager](https://junglewise.ai/threats/technologies/access-manager) (Oracle) | 15 | 10 | 4 | 0 | 10 |
| 24 | [Oracle Commerce Guided Search](https://junglewise.ai/threats/technologies/commerce-guided-search) (Oracle) | 25 | 0 | 23 | 0 | 8.2 |
| 25 | [Oracle BI Publisher](https://junglewise.ai/threats/technologies/bi-publisher) (Oracle) | 21 | 2 | 19 | 0 | 9.8 |

## Most affected vendors

1. [Oracle](https://junglewise.ai/threats/vendors/oracle): 592 vulnerabilities, 83 critical, 0 exploited
2. [Linux](https://junglewise.ai/threats/vendors/linux): 867 vulnerabilities, 32 critical, 0 exploited
3. [Apple](https://junglewise.ai/threats/vendors/apple): 252 vulnerabilities, 8 critical, 0 exploited
4. [Google](https://junglewise.ai/threats/vendors/google): 151 vulnerabilities, 13 critical, 1 exploited
5. [Cisco](https://junglewise.ai/threats/vendors/cisco): 83 vulnerabilities, 29 critical, 2 exploited
6. [Mozilla](https://junglewise.ai/threats/vendors/mozilla): 77 vulnerabilities, 21 critical, 0 exploited
7. [IBM](https://junglewise.ai/threats/vendors/ibm): 95 vulnerabilities, 5 critical, 0 exploited
8. [Go](https://junglewise.ai/threats/vendors/go): 74 vulnerabilities, 5 critical, 0 exploited
9. [Pip](https://junglewise.ai/threats/vendors/pypi): 56 vulnerabilities, 11 critical, 0 exploited
10. [Npm](https://junglewise.ai/threats/vendors/npm): 55 vulnerabilities, 7 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-76460: A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to…](https://junglewise.ai/threats/cve-2026-76460-cisco-identity-services-engine-incorrect-privileged-api-use) (critical, exploited in the wild, CVSS 10, published 16 Sep 2026)
- [CVE-2026-76461: A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an…](https://junglewise.ai/threats/cve-2026-76461-cisco-secure-email-gateway-sql-injection) (critical, exploited in the wild, CVSS 9.8, published 14 Sep 2026)
- [CVE-2026-58704: In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote…](https://junglewise.ai/threats/cve-2026-58704-google-pixel-improper-authorization-in-cellular-modem) (critical, exploited in the wild, CVSS 8.8, published 15 Sep 2026)
- [CVE-2026-87886: Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin…](https://junglewise.ai/threats/cve-2026-87886-acronis-backup-privilege-escalation-in-cpanel-whm-and-plesk) (critical, exploited in the wild, CVSS 7.8, published 17 Sep 2026)
- [CVE-2026-53710: MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the…](https://junglewise.ai/threats/cve-2026-53710-ibm-mcp-contextforge-gateway-restrictedpython-sandbox-bypass-via) (critical, CVSS 10, published 15 Sep 2026)
- [CVE-2026-92937: vm2 sandbox escape in Promise rejection handling](https://junglewise.ai/threats/cve-2026-92937-vm2-sandbox-escape-in-promise-rejection-handling) (critical, CVSS 10, published 17 Sep 2026)
- [CVE-2026-94003: A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file…](https://junglewise.ai/threats/cve-2026-94003-a-vulnerability-has-been-found-in-comfast-cf-n1-s-2-6-0-1) (critical, CVSS 10, published 20 Sep 2026)
- [CVE-2026-94089: A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file…](https://junglewise.ai/threats/cve-2026-94089-a-vulnerability-was-determined-in-d-link-dir-868l-2-01b05-this) (critical, CVSS 10, published 20 Sep 2026)
- [CVE-2026-70200: Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized…](https://junglewise.ai/threats/cve-2026-70200-improper-limitation-of-a-pathname-to-a-restricted-directory-path) (critical, CVSS 10, published 17 Sep 2026)
- [CVE-2026-69843: Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.](https://junglewise.ai/threats/cve-2026-69843-authentication-bypass-by-spoofing-in-microsoft-fabric-allows-an) (critical, CVSS 10, published 18 Sep 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 14 to 20 September 2026 (week 38)", https://junglewise.ai/threats/weekly/2026-09-14, 26 September 2026.