Weekly report
Most vulnerable technologies: week of 28 September to 4 October 2026 (week 40)
Final report, published . It does not change.
In the week of 28 September to 4 October 2026, Junglewise Threat Intelligence recorded 2,669 new vulnerabilities: 209 critical, 851 high and 6 exploited in the wild. The most vulnerable technology was Google Chrome, with 152 vulnerabilities (24 critical), followed by Mozilla Firefox (75) and NVIDIA GPU Display Driver (73).
- New vulnerabilities
- 2,669
- Critical
- 209
- Exploited in the wild
- 6
- Technologies affected
- 1,544
Ranking
Most affected vendors
- 1.Google162 vulnerabilities, 24 critical, 0 exploited
- 2.Nvidia116 vulnerabilities, 0 critical, 0 exploited
- 3.Apache151 vulnerabilities, 10 critical, 0 exploited
- 4.Mozilla79 vulnerabilities, 9 critical, 0 exploited
- 5.Kiteworks60 vulnerabilities, 9 critical, 0 exploited
- 6.YesWiki36 vulnerabilities, 0 critical, 0 exploited
- 7.Netcore11 vulnerabilities, 9 critical, 0 exploited
- 8.Jetbrains34 vulnerabilities, 0 critical, 0 exploited
- 9.Ziroom9 vulnerabilities, 9 critical, 0 exploited
- 10.Hpe18 vulnerabilities, 5 critical, 0 exploited
Most severe vulnerabilities
- CVE-2026-104286: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail…criticalexploited in the wildCVSS 9.8EPSS 2.2%
- CVE-2026-76504: Cisco Catalyst SD-WAN Manager API authentication bypasscriticalexploited in the wildCVSS 9.8
- CVE-2026-86950: Apple CoreGraphics out-of-bounds write in file processingcriticalexploited in the wildCVSS 8.8EPSS 0.8%
- CVE-2026-88779: Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before…criticalexploited in the wildCVSS 7.5EPSS 0.5%
- CVE-2026-102489: Zammad session hijack leading to remote code executioncriticalexploited in the wildEPSS 0.6%
- CVE-2026-102490: Zammad privilege escalation to rootcriticalexploited in the wildEPSS 0.3%
- CVE-2026-105134: Ahsay AhsayCBS OS command injection in UpdateReceiverscriticalCVSS 10EPSS 1.8%
- CVE-2026-105135: InternLM MindSearch code injection in planner agentcriticalCVSS 10EPSS 0.8%
- CVE-2026-104610: Tenda HG7/HG9/HG10 stack buffer overflow in formLoopBackcriticalCVSS 10EPSS 0.6%
- CVE-2026-103956: Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote…criticalCVSS 10EPSS 0.5%
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
Technologies are ranked by a score: 10 points for each vulnerability exploited in the wild, 5 for each critical, 2 for each high and 1 for every vulnerability. A vulnerability counts once for every technology it affects, so one advisory can appear under several products.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/weekly/2026-09-28.json, and this page as text at https://junglewise.ai/threats/weekly/2026-09-28.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 28 September to 4 October 2026 (week 40)", https://junglewise.ai/threats/weekly/2026-09-28, 6 October 2026.