Weekly report
Most vulnerable technologies: week of 21 to 27 September 2026 (week 39)
Final report, published . It does not change.
In the week of 21 to 27 September 2026, Junglewise Threat Intelligence recorded 2,950 new vulnerabilities: 192 critical, 892 high and 6 exploited in the wild. The most vulnerable technology was Linux Kernel, with 607 vulnerabilities (20 critical), followed by Microsoft Windows (28) and IBM Financial Transaction Manager (45).
- New vulnerabilities
- 2,950
- Critical
- 192
- Exploited in the wild
- 6
- Technologies affected
- 1,253
Ranking
Most affected vendors
- 1.Linux589 vulnerabilities, 20 critical, 0 exploited
- 2.IBM96 vulnerabilities, 12 critical, 0 exploited
- 3.Adobe53 vulnerabilities, 25 critical, 0 exploited
- 4.Microsoft30 vulnerabilities, 22 critical, 0 exploited
- 5.Openclaw73 vulnerabilities, 0 critical, 0 exploited
- 6.Apache43 vulnerabilities, 7 critical, 0 exploited
- 7.Red Hat42 vulnerabilities, 4 critical, 0 exploited
- 8.Foxit31 vulnerabilities, 0 critical, 0 exploited
- 9.Lantronix13 vulnerabilities, 10 critical, 0 exploited
- 10.Zoho15 vulnerabilities, 2 critical, 0 exploited
Most severe vulnerabilities
- CVE-2026-93952: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access…criticalexploited in the wildCVSS 10EPSS 0.9%
- CVE-2026-93616: A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary…criticalexploited in the wildCVSS 9.8EPSS 19.7%
- CVE-2026-94127: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can…criticalexploited in the wildCVSS 9.8EPSS 2.2%
- CVE-2026-87902: An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php`…criticalexploited in the wildCVSS 8.1EPSS 2.9%
- CVE-2026-88772: Citrix NetScaler ADC and Gateway remote code execution and denial of servicecriticalexploited in the wild
- CVE-2026-88771: Citrix NetScaler ADC and Gateway improper input validationcriticalexploited in the wild
- CVE-2026-94097: Netcore NBR200V2 command injection in network tools CGIcriticalCVSS 10EPSS 2.9%
- CVE-2026-80155: Lantronix SLC8000 SLC9000 EMG authentication bypass in web management portalcriticalCVSS 10EPSS 1.7%
- CVE-2026-89275: Adobe Campaign Classic code injection vulnerabilitycriticalCVSS 10EPSS 1.3%
- CVE-2026-84412: Adobe Campaign Classic code injectioncriticalCVSS 10EPSS 1.3%
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
Technologies are ranked by a score: 10 points for each vulnerability exploited in the wild, 5 for each critical, 2 for each high and 1 for every vulnerability. A vulnerability counts once for every technology it affects, so one advisory can appear under several products.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/weekly/2026-09-21.json, and this page as text at https://junglewise.ai/threats/weekly/2026-09-21.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 21 to 27 September 2026 (week 39)", https://junglewise.ai/threats/weekly/2026-09-21, 29 September 2026.