{"schema_version":1,"title":"Most vulnerable technologies: week of 28 September to 4 October 2026 (week 40)","summary":"In the week of 28 September to 4 October 2026, Junglewise Threat Intelligence recorded 2,669 new vulnerabilities: 209 critical, 851 high and 6 exploited in the wild. The most vulnerable technology was Google Chrome, with 152 vulnerabilities (24 critical), followed by Mozilla Firefox (75) and NVIDIA GPU Display Driver (73).","url":"https://junglewise.ai/threats/weekly/2026-09-28","json_url":"https://junglewise.ai/threats/weekly/2026-09-28.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/weekly/2026-09-28","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","method":"Technologies are ranked by 10 points per vulnerability exploited in the wild, 5 per critical, 2 per high and 1 per vulnerability, over vulnerabilities published in the period (UTC). A vulnerability counts for every technology it affects.","kind":"week","period":{"end":"2026-10-04","start":"2026-09-28"},"totals":{"high":851,"tracked":3325,"critical":209,"exploited":6,"technologies":1544,"vulnerabilities":2669},"notable":[{"cve":"CVE-2026-104286","cvss":9.8,"epss":0.022,"slug":"cve-2026-104286-fortinet-fortimail-path-traversal-vulnerability","title":"An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, F","severity":"critical","exploited":true,"published_at":"2026-10-01T20:17:24.01+00:00","url":"https://junglewise.ai/threats/cve-2026-104286-fortinet-fortimail-path-traversal-vulnerability"},{"cve":"CVE-2026-76504","cvss":9.8,"slug":"cve-2026-76504-a-vulnerability-in-the-api-session-based-authentication","title":"Cisco Catalyst SD-WAN Manager API authentication bypass","severity":"critical","exploited":true,"published_at":"2026-09-30T13:17:20.247+00:00","url":"https://junglewise.ai/threats/cve-2026-76504-a-vulnerability-in-the-api-session-based-authentication"},{"cve":"CVE-2026-86950","cvss":8.8,"epss":0.0081,"slug":"cve-2026-86950-an-out-of-bounds-write-issue-was-addressed-with-improved-bounds","title":"Apple CoreGraphics out-of-bounds write in file processing","severity":"critical","exploited":true,"published_at":"2026-09-28T20:17:11.193+00:00","url":"https://junglewise.ai/threats/cve-2026-86950-an-out-of-bounds-write-issue-was-addressed-with-improved-bounds"},{"cve":"CVE-2026-88779","cvss":7.5,"epss":0.0053,"slug":"cve-2026-88779-cisa-adds-one-known-exploited-vulnerability-to-catalog","title":"Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS","severity":"critical","exploited":true,"published_at":"2026-10-04T04:16:43.68+00:00","url":"https://junglewise.ai/threats/cve-2026-88779-cisa-adds-one-known-exploited-vulnerability-to-catalog"},{"cve":"CVE-2026-102489","epss":0.0058,"slug":"cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack","title":"Zammad session hijack leading to remote code execution","severity":"critical","exploited":true,"published_at":"2026-09-30T17:16:40.55+00:00","url":"https://junglewise.ai/threats/cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack"},{"cve":"CVE-2026-102490","epss":0.0026,"slug":"cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the","title":"Zammad privilege escalation to root","severity":"critical","exploited":true,"published_at":"2026-09-30T17:16:40.707+00:00","url":"https://junglewise.ai/threats/cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the"},{"cve":"CVE-2026-105134","cvss":10,"epss":0.0184,"slug":"cve-2026-105134-a-flaw-has-been-found-in-ahsay-ahsaycbs-up-to-10-3-2-this","title":"Ahsay AhsayCBS OS command injection in UpdateReceivers","severity":"critical","exploited":false,"published_at":"2026-10-04T07:16:33.48+00:00","url":"https://junglewise.ai/threats/cve-2026-105134-a-flaw-has-been-found-in-ahsay-ahsaycbs-up-to-10-3-2-this"},{"cve":"CVE-2026-105135","cvss":10,"epss":0.0077,"slug":"cve-2026-105135-a-vulnerability-has-been-found-in-internlm-mindsearch-0-1-0-this","title":"InternLM MindSearch code injection in planner agent","severity":"critical","exploited":false,"published_at":"2026-10-04T07:16:33.693+00:00","url":"https://junglewise.ai/threats/cve-2026-105135-a-vulnerability-has-been-found-in-internlm-mindsearch-0-1-0-this"},{"cve":"CVE-2026-104610","cvss":10,"epss":0.0064,"slug":"cve-2026-104610-a-security-vulnerability-has-been-detected-in-tenda-hg7-hg9-and","title":"Tenda HG7/HG9/HG10 stack buffer overflow in formLoopBack","severity":"critical","exploited":false,"published_at":"2026-10-02T13:17:44.45+00:00","url":"https://junglewise.ai/threats/cve-2026-104610-a-security-vulnerability-has-been-detected-in-tenda-hg7-hg9-and"},{"cve":"CVE-2026-103956","cvss":10,"epss":0.0047,"slug":"cve-2026-103956-and-issues-in-loom-for-aws","title":"Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain s","severity":"critical","exploited":false,"published_at":"2026-10-02T19:16:39.75+00:00","url":"https://junglewise.ai/threats/cve-2026-103956-and-issues-in-loom-for-aws"}],"vendors":[{"hub":true,"high":47,"name":"Google","rank":1,"slug":"google","critical":24,"exploited":0,"vulnerabilities":162,"url":"https://junglewise.ai/threats/vendors/google"},{"hub":true,"high":78,"name":"Nvidia","rank":2,"slug":"nvidia","critical":0,"exploited":0,"vulnerabilities":116,"url":"https://junglewise.ai/threats/vendors/nvidia"},{"hub":true,"high":22,"name":"Apache","rank":3,"slug":"apache","critical":10,"exploited":0,"vulnerabilities":151,"url":"https://junglewise.ai/threats/vendors/apache"},{"hub":true,"high":33,"name":"Mozilla","rank":4,"slug":"mozilla","critical":9,"exploited":0,"vulnerabilities":79,"url":"https://junglewise.ai/threats/vendors/mozilla"},{"hub":true,"high":34,"name":"Kiteworks","rank":5,"slug":"kiteworks","critical":9,"exploited":0,"vulnerabilities":60,"url":"https://junglewise.ai/threats/vendors/kiteworks"},{"hub":true,"high":14,"name":"YesWiki","rank":6,"slug":"yeswiki","critical":0,"exploited":0,"vulnerabilities":36,"url":"https://junglewise.ai/threats/vendors/yeswiki"},{"hub":true,"high":2,"name":"Netcore","rank":7,"slug":"netcore","critical":9,"exploited":0,"vulnerabilities":11,"url":"https://junglewise.ai/threats/vendors/netcore"},{"hub":true,"high":12,"name":"Jetbrains","rank":8,"slug":"jetbrains","critical":0,"exploited":0,"vulnerabilities":34,"url":"https://junglewise.ai/threats/vendors/jetbrains"},{"hub":true,"high":0,"name":"Ziroom","rank":9,"slug":"ziroom","critical":9,"exploited":0,"vulnerabilities":9,"url":"https://junglewise.ai/threats/vendors/ziroom"},{"hub":true,"high":5,"name":"Hpe","rank":10,"slug":"hpe","critical":5,"exploited":0,"vulnerabilities":18,"url":"https://junglewise.ai/threats/vendors/hpe"}],"generated_at":"2026-10-06T00:07:00.137771+00:00","technologies":[{"hub":true,"top":[{"cve":"CVE-2026-103628","cvss":9.6,"epss":0.0033,"slug":"cve-2026-103628-out-of-bounds-write-in-webgl-in-google-chrome-prior-to-154-0","title":"Google Chrome out-of-bounds write in WebGL","severity":"critical","exploited":false,"published_at":"2026-10-02T16:16:43.937+00:00","url":"https://junglewise.ai/threats/cve-2026-103628-out-of-bounds-write-in-webgl-in-google-chrome-prior-to-154-0"},{"cve":"CVE-2026-103626","cvss":9.6,"epss":0.0029,"slug":"cve-2026-103626-incorrect-authorization-in-filesystem-in-google-chrome-on-on","title":"Google Chrome FileSystem incorrect authorization in sandbox escape","severity":"critical","exploited":false,"published_at":"2026-10-02T16:16:43.717+00:00","url":"https://junglewise.ai/threats/cve-2026-103626-incorrect-authorization-in-filesystem-in-google-chrome-on-on"},{"cve":"CVE-2026-102331","cvss":9.6,"slug":"cve-2026-102331-buffer-overflow-in-angle-in-google-chrome-on-on-android-prior-to","title":"Google Chrome buffer overflow in ANGLE on Android","severity":"critical","exploited":false,"published_at":"2026-09-29T20:17:16.587+00:00","url":"https://junglewise.ai/threats/cve-2026-102331-buffer-overflow-in-angle-in-google-chrome-on-on-android-prior-to"}],"high":42,"name":"Google Chrome","rank":1,"slug":"chrome","score":356,"vendor":{"name":"Google","slug":"google"},"critical":24,"max_cvss":9.6,"max_epss":0.0033,"exploited":0,"vulnerabilities":152,"url":"https://junglewise.ai/threats/technologies/chrome"},{"hub":true,"top":[{"cve":"CVE-2026-100819","cvss":9.6,"slug":"cve-2026-100819-sandbox-escape-due-to-incorrect-boundary-conditions-in-the-xpcom","title":"Mozilla Firefox sandbox escape in XPCOM component","severity":"critical","exploited":false,"published_at":"2026-09-29T13:17:47.193+00:00","url":"https://junglewise.ai/threats/cve-2026-100819-sandbox-escape-due-to-incorrect-boundary-conditions-in-the-xpcom"},{"cve":"CVE-2026-100818","cvss":9.6,"slug":"cve-2026-100818-sandbox-escape-due-to-use-after-free-in-the-widget-gtk-component","title":"Firefox sandbox escape due to use-after-free in Widget: Gtk","severity":"critical","exploited":false,"published_at":"2026-09-29T13:17:47.037+00:00","url":"https://junglewise.ai/threats/cve-2026-100818-sandbox-escape-due-to-use-after-free-in-the-widget-gtk-component"},{"cve":"CVE-2026-100811","cvss":9.6,"slug":"cve-2026-100811-sandbox-escape-due-to-use-after-free-in-the-dom-core-html","title":"Firefox sandbox escape due to use-after-free in DOM","severity":"critical","exploited":false,"published_at":"2026-09-29T13:17:46.23+00:00","url":"https://junglewise.ai/threats/cve-2026-100811-sandbox-escape-due-to-use-after-free-in-the-dom-core-html"}],"high":32,"name":"Mozilla Firefox","rank":2,"slug":"firefox","score":184,"vendor":{"name":"Mozilla","slug":"mozilla"},"critical":9,"max_cvss":9.6,"max_epss":null,"exploited":0,"vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/firefox"},{"hub":true,"top":[{"cve":"CVE-2026-47601","cvss":7.8,"slug":"cve-2026-47601-nvidia-gpu-display-driver-for-windows-and-linux-contains-a","title":"NVIDIA GPU Display Driver DMA-BUF privilege escalation","severity":"high","exploited":false,"published_at":"2026-09-30T16:17:30.563+00:00","url":"https://junglewise.ai/threats/cve-2026-47601-nvidia-gpu-display-driver-for-windows-and-linux-contains-a"},{"cve":"CVE-2026-47600","cvss":7.8,"slug":"cve-2026-47600-nvidia-gpu-display-driver-for-windows-and-linux-contains-a","title":"NVIDIA GPU Display Driver kernel mode error-handling code execution","severity":"high","exploited":false,"published_at":"2026-09-30T16:17:30.4+00:00","url":"https://junglewise.ai/threats/cve-2026-47600-nvidia-gpu-display-driver-for-windows-and-linux-contains-a"},{"cve":"CVE-2026-47599","cvss":7.8,"slug":"cve-2026-47599-nvidia-gpu-display-driver-for-linux-contains-a-vulnerability-in","title":"NVIDIA GPU Display Driver for Linux DMA memory access vulnerability","severity":"high","exploited":false,"published_at":"2026-09-30T16:17:30.27+00:00","url":"https://junglewise.ai/threats/cve-2026-47599-nvidia-gpu-display-driver-for-linux-contains-a-vulnerability-in"}],"high":45,"name":"NVIDIA GPU Display Driver","rank":3,"slug":"gpu-display-driver","score":163,"vendor":{"name":"Nvidia","slug":"nvidia"},"critical":0,"max_cvss":7.8,"max_epss":null,"exploited":0,"vulnerabilities":73,"url":"https://junglewise.ai/threats/technologies/gpu-display-driver"},{"hub":true,"top":[{"cve":"CVE-2026-100819","cvss":9.6,"slug":"cve-2026-100819-sandbox-escape-due-to-incorrect-boundary-conditions-in-the-xpcom","title":"Mozilla Firefox sandbox escape in XPCOM component","severity":"critical","exploited":false,"published_at":"2026-09-29T13:17:47.193+00:00","url":"https://junglewise.ai/threats/cve-2026-100819-sandbox-escape-due-to-incorrect-boundary-conditions-in-the-xpcom"},{"cve":"CVE-2026-100818","cvss":9.6,"slug":"cve-2026-100818-sandbox-escape-due-to-use-after-free-in-the-widget-gtk-component","title":"Firefox sandbox escape due to use-after-free in Widget: Gtk","severity":"critical","exploited":false,"published_at":"2026-09-29T13:17:47.037+00:00","url":"https://junglewise.ai/threats/cve-2026-100818-sandbox-escape-due-to-use-after-free-in-the-widget-gtk-component"},{"cve":"CVE-2026-100811","cvss":9.6,"slug":"cve-2026-100811-sandbox-escape-due-to-use-after-free-in-the-dom-core-html","title":"Firefox sandbox escape due to use-after-free in DOM","severity":"critical","exploited":false,"published_at":"2026-09-29T13:17:46.23+00:00","url":"https://junglewise.ai/threats/cve-2026-100811-sandbox-escape-due-to-use-after-free-in-the-dom-core-html"}],"high":27,"name":"Mozilla Firefox ESR","rank":4,"slug":"firefox-esr","score":156,"vendor":{"name":"Mozilla","slug":"mozilla"},"critical":8,"max_cvss":9.6,"max_epss":null,"exploited":0,"vulnerabilities":62,"url":"https://junglewise.ai/threats/technologies/firefox-esr"},{"hub":true,"top":[{"cve":"CVE-2026-102115","cvss":9.8,"slug":"cve-2026-102115-kiteworks-core-did-not-correctly-validate-a-parameter-submitted","title":"Kiteworks Core authentication bypass in password reset","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:59.18+00:00","url":"https://junglewise.ai/threats/cve-2026-102115-kiteworks-core-did-not-correctly-validate-a-parameter-submitted"},{"cve":"CVE-2026-102147","cvss":9.3,"slug":"cve-2026-102147-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core","title":"Kiteworks Core stored cross-site scripting in administrative interface","severity":"critical","exploited":false,"published_at":"2026-09-30T21:17:03.633+00:00","url":"https://junglewise.ai/threats/cve-2026-102147-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core"},{"cve":"CVE-2026-102120","cvss":8.8,"slug":"cve-2026-102120-a-privilege-escalation-vulnerability-in-kiteworks-could-have","title":"Kiteworks Core privilege escalation through OS command injection","severity":"high","exploited":false,"published_at":"2026-09-30T21:17:00.057+00:00","url":"https://junglewise.ai/threats/cve-2026-102120-a-privilege-escalation-vulnerability-in-kiteworks-could-have"}],"high":18,"name":"Kiteworks Core","rank":5,"slug":"kiteworks-core","score":79,"vendor":{"name":"Kiteworks","slug":"kiteworks"},"critical":2,"max_cvss":9.8,"max_epss":null,"exploited":0,"vulnerabilities":33,"url":"https://junglewise.ai/threats/technologies/kiteworks-core"},{"hub":true,"top":[{"cve":"CVE-2026-102149","cvss":9.4,"slug":"cve-2026-102149-kiteworks-email-protection-gateway-did-not-sufficiently-restrict","title":"Kiteworks Email Protection Gateway improper access control on certificate assignment","severity":"critical","exploited":false,"published_at":"2026-09-30T21:17:03.76+00:00","url":"https://junglewise.ai/threats/cve-2026-102149-kiteworks-email-protection-gateway-did-not-sufficiently-restrict"},{"cve":"CVE-2026-102106","cvss":9.1,"slug":"cve-2026-102106-improper-authentication-in-a-kiteworks-email-protection-gateway","title":"Kiteworks Email Protection Gateway auth bypass in administrative service","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:57.49+00:00","url":"https://junglewise.ai/threats/cve-2026-102106-improper-authentication-in-a-kiteworks-email-protection-gateway"},{"cve":"CVE-2026-102105","cvss":9.1,"slug":"cve-2026-102105-kiteworks-email-protection-gateway-before-version-9-5-0-is","title":"Kiteworks Email Protection Gateway SSRF","severity":"critical","exploited":false,"published_at":"2026-09-30T21:16:57.37+00:00","url":"https://junglewise.ai/threats/cve-2026-102105-kiteworks-email-protection-gateway-before-version-9-5-0-is"}],"high":11,"name":"Kiteworks Email Protection Gateway","rank":6,"slug":"email-protection-gateway","score":79,"vendor":{"name":"Kiteworks","slug":"kiteworks"},"critical":7,"max_cvss":9.4,"max_epss":null,"exploited":0,"vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/email-protection-gateway"},{"hub":true,"top":[{"cve":"CVE-2026-104464","cvss":8.6,"epss":0.0029,"slug":"cve-2026-104464-yeswiki-before-4-6-7-contains-a-server-side-request-forgery","title":"YesWiki server-side request forgery in Bazar abonnements sync","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:18.873+00:00","url":"https://junglewise.ai/threats/cve-2026-104464-yeswiki-before-4-6-7-contains-a-server-side-request-forgery"},{"cve":"CVE-2026-104457","cvss":8.6,"epss":0.0028,"slug":"cve-2026-104457-yeswiki-before-4-6-7-contains-an-sql-injection-vulnerability-in","title":"YesWiki SQL injection in Bazar filtertags action","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:17.653+00:00","url":"https://junglewise.ai/threats/cve-2026-104457-yeswiki-before-4-6-7-contains-an-sql-injection-vulnerability-in"},{"cve":"CVE-2026-104445","cvss":8.2,"epss":0.004,"slug":"cve-2026-104445-yeswiki-before-4-6-7-contains-an-authentication-bypass","title":"YesWiki ActivityPub authentication bypass via actor spoofing","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:15.657+00:00","url":"https://junglewise.ai/threats/cve-2026-104445-yeswiki-before-4-6-7-contains-an-authentication-bypass"}],"high":14,"name":"YesWiki","rank":7,"slug":"yeswiki","score":65,"vendor":{"name":"YesWiki","slug":"yeswiki"},"critical":0,"max_cvss":8.6,"max_epss":0.0044,"exploited":0,"vulnerabilities":37,"url":"https://junglewise.ai/threats/technologies/yeswiki"},{"hub":true,"top":[{"cve":"CVE-2026-96289","epss":0.0043,"slug":"cve-2026-96289-uncontrolled-recursion-vulnerability-in-apache-thrift-php","title":"Apache Thrift uncontrolled recursion in PHP bindings","severity":"info","exploited":false,"published_at":"2026-10-02T13:18:05.977+00:00","url":"https://junglewise.ai/threats/cve-2026-96289-uncontrolled-recursion-vulnerability-in-apache-thrift-php"},{"cve":"CVE-2026-96287","epss":0.0043,"slug":"cve-2026-96287-inefficient-algorithmic-complexity-vulnerability-in-apache-thrift","title":"Apache Thrift Perl bindings inefficient algorithmic complexity","severity":"info","exploited":false,"published_at":"2026-10-02T13:18:05.627+00:00","url":"https://junglewise.ai/threats/cve-2026-96287-inefficient-algorithmic-complexity-vulnerability-in-apache-thrift"},{"cve":"CVE-2026-96286","epss":0.0043,"slug":"cve-2026-96286-uncaught-exception-vulnerability-in-apache-thrift-perl-bindings","title":"Apache Thrift uncaught exception in Perl bindings","severity":"info","exploited":false,"published_at":"2026-10-02T13:18:05.247+00:00","url":"https://junglewise.ai/threats/cve-2026-96286-uncaught-exception-vulnerability-in-apache-thrift-perl-bindings"}],"high":0,"name":"Apache Thrift","rank":8,"slug":"thrift","score":60,"vendor":{"name":"Apache","slug":"apache"},"critical":0,"max_cvss":null,"max_epss":0.0055,"exploited":0,"vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/thrift"},{"hub":true,"top":[{"cve":"CVE-2026-47600","cvss":7.8,"slug":"cve-2026-47600-nvidia-gpu-display-driver-for-windows-and-linux-contains-a","title":"NVIDIA GPU Display Driver kernel mode error-handling code execution","severity":"high","exploited":false,"published_at":"2026-09-30T16:17:30.4+00:00","url":"https://junglewise.ai/threats/cve-2026-47600-nvidia-gpu-display-driver-for-windows-and-linux-contains-a"},{"cve":"CVE-2026-47597","cvss":7.8,"slug":"cve-2026-47597-nvidia-gpu-display-driver-for-windows-and-linux-contains-a","title":"NVIDIA GPU Display Driver use-after-free in Resource Server","severity":"high","exploited":false,"published_at":"2026-09-30T16:17:29.963+00:00","url":"https://junglewise.ai/threats/cve-2026-47597-nvidia-gpu-display-driver-for-windows-and-linux-contains-a"},{"cve":"CVE-2026-47595","cvss":7.8,"slug":"cve-2026-47595-nvidia-gpu-display-driver-for-linux-contains-a-vulnerability-in","title":"NVIDIA GPU Display Driver for Linux kernel mode memory permissions vulnerability","severity":"high","exploited":false,"published_at":"2026-09-30T16:17:29.68+00:00","url":"https://junglewise.ai/threats/cve-2026-47595-nvidia-gpu-display-driver-for-linux-contains-a-vulnerability-in"}],"high":14,"name":"Nvidia GPU Display Driver for Linux","rank":9,"slug":"gpu-display-driver-for-linux","score":50,"vendor":{"name":"Nvidia","slug":"nvidia"},"critical":0,"max_cvss":7.8,"max_epss":null,"exploited":0,"vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/gpu-display-driver-for-linux"},{"hub":true,"top":[{"cve":"CVE-2026-59797","cvss":9.8,"epss":0.0039,"slug":"cve-2026-59797-improper-privilege-management-vulnerability-in-apache-http-server","title":"Apache HTTP Server mod_ssl privilege escalation in SSLRequire expressions","severity":"critical","exploited":false,"published_at":"2026-10-01T17:17:29.527+00:00","url":"https://junglewise.ai/threats/cve-2026-59797-improper-privilege-management-vulnerability-in-apache-http-server"},{"cve":"CVE-2026-57941","cvss":9.8,"epss":0.0044,"slug":"cve-2026-57941-use-after-free-vulnerability-in-apache-http-server-s-mod-http2","title":"Apache HTTP Server mod_http2 use-after-free via shared session bbtmp","severity":"critical","exploited":false,"published_at":"2026-10-01T17:17:27.457+00:00","url":"https://junglewise.ai/threats/cve-2026-57941-use-after-free-vulnerability-in-apache-http-server-s-mod-http2"},{"cve":"CVE-2026-56154","cvss":9.8,"epss":0.0042,"slug":"cve-2026-56154-use-after-free-vulnerability-in-apache-http-server-s-mod-rewrite","title":"Apache HTTP Server mod_rewrite use-after-free via lookahead","severity":"critical","exploited":false,"published_at":"2026-10-01T17:17:26.61+00:00","url":"https://junglewise.ai/threats/cve-2026-56154-use-after-free-vulnerability-in-apache-http-server-s-mod-rewrite"}],"high":9,"name":"Apache HTTP Server","rank":10,"slug":"http-server","score":49,"vendor":{"name":"Apache","slug":"apache"},"critical":3,"max_cvss":9.8,"max_epss":0.0061,"exploited":0,"vulnerabilities":16,"url":"https://junglewise.ai/threats/technologies/http-server"},{"hub":true,"top":[{"cve":"CVE-2026-102794","cvss":9.1,"slug":"cve-2026-102794-a-vulnerability-has-been-found-in-ziroom-zhome-a0101-1-0-1-0","title":"Ziroom ZHOME A0101 command injection in /api/ZRnetwork/ping","severity":"critical","exploited":false,"published_at":"2026-09-30T00:16:34.963+00:00","url":"https://junglewise.ai/threats/cve-2026-102794-a-vulnerability-has-been-found-in-ziroom-zhome-a0101-1-0-1-0"},{"cve":"CVE-2026-102793","cvss":9.1,"slug":"cve-2026-102793-a-flaw-has-been-found-in-ziroom-zhome-a0101-1-0-1-0-this","title":"Ziroom ZHOME A0101 command injection in set_time_zone","severity":"critical","exploited":false,"published_at":"2026-09-30T00:16:33.743+00:00","url":"https://junglewise.ai/threats/cve-2026-102793-a-flaw-has-been-found-in-ziroom-zhome-a0101-1-0-1-0-this"},{"cve":"CVE-2026-102792","cvss":9.1,"slug":"cve-2026-102792-a-vulnerability-was-detected-in-ziroom-zhome-a0101-1-0-1-0-this","title":"Ziroom ZHOME A0101 command injection in set_syslog","severity":"critical","exploited":false,"published_at":"2026-09-29T23:17:21.267+00:00","url":"https://junglewise.ai/threats/cve-2026-102792-a-vulnerability-was-detected-in-ziroom-zhome-a0101-1-0-1-0-this"}],"high":0,"name":"Ziroom ZHOME A0101","rank":11,"slug":"zhome-a0101","score":48,"vendor":{"name":"Ziroom","slug":"ziroom"},"critical":8,"max_cvss":9.1,"max_epss":null,"exploited":0,"vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/zhome-a0101"},{"hub":true,"top":[{"cve":"CVE-2026-82377","cvss":9.9,"slug":"cve-2026-82377-missing-authorization-in-apache-roller-6-1-5-allows-an","title":"Apache Roller missing authorization in XML-RPC APIs","severity":"critical","exploited":false,"published_at":"2026-09-28T08:16:41.417+00:00","url":"https://junglewise.ai/threats/cve-2026-82377-missing-authorization-in-apache-roller-6-1-5-allows-an"},{"cve":"CVE-2026-82384","cvss":9.8,"slug":"cve-2026-82384-deserialization-of-untrusted-data-in-apache-roller-6-1-5-allows","title":"Apache Roller XML-RPC deserialization of untrusted data","severity":"critical","exploited":false,"published_at":"2026-09-28T08:16:42.273+00:00","url":"https://junglewise.ai/threats/cve-2026-82384-deserialization-of-untrusted-data-in-apache-roller-6-1-5-allows"},{"cve":"CVE-2026-82378","cvss":9,"slug":"cve-2026-82378-incorrect-authorization-in-the-oauth-1-0a-authorization-endpoint","title":"Apache Roller incorrect authorization in OAuth 1.0a endpoint","severity":"critical","exploited":false,"published_at":"2026-09-28T08:16:41.54+00:00","url":"https://junglewise.ai/threats/cve-2026-82378-incorrect-authorization-in-the-oauth-1-0a-authorization-endpoint"}],"high":7,"name":"Apache Roller","rank":12,"slug":"roller","score":47,"vendor":{"name":"Apache","slug":"apache"},"critical":3,"max_cvss":9.9,"max_epss":null,"exploited":0,"vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/roller"},{"hub":true,"top":[{"cve":"CVE-2026-71379","cvss":10,"slug":"cve-2026-71379-toptech-tms7-and-tophat","title":"The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:21.56+00:00","url":"https://junglewise.ai/threats/cve-2026-71379-toptech-tms7-and-tophat"},{"cve":"CVE-2026-70356","cvss":9.1,"slug":"cve-2026-70356-the-tms-file-upload-endpoint-fails-to-enforce-server-side-file","title":"Toptech TMS7 unrestricted file upload in file endpoint","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:16.14+00:00","url":"https://junglewise.ai/threats/cve-2026-70356-the-tms-file-upload-endpoint-fails-to-enforce-server-side-file"},{"cve":"CVE-2026-72510","cvss":9,"slug":"cve-2026-72510-the-supplier-no-parameter-used-in-the-business-allocation-search","title":"Toptech TMS7 and TopHAT SQL injection in business allocation search","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:22.607+00:00","url":"https://junglewise.ai/threats/cve-2026-72510-the-supplier-no-parameter-used-in-the-business-allocation-search"}],"high":1,"name":"Toptech Systems TMS7","rank":13,"slug":"tms7","score":45,"vendor":{"name":"Toptech Systems","slug":"toptech-systems"},"critical":7,"max_cvss":10,"max_epss":null,"exploited":0,"vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/tms7"},{"hub":true,"top":[{"cve":"CVE-2026-100277","cvss":8.9,"slug":"cve-2026-100277-in-jetbrains-youtrack-before-2026-2-19197-account-takeover-was","title":"JetBrains YouTrack notification signature replay leading to account takeover","severity":"high","exploited":false,"published_at":"2026-09-30T16:16:59.38+00:00","url":"https://junglewise.ai/threats/cve-2026-100277-in-jetbrains-youtrack-before-2026-2-19197-account-takeover-was"},{"cve":"CVE-2026-100273","cvss":8.2,"slug":"cve-2026-100273-in-jetbrains-youtrack-before-2026-2-19197-authorisation-bypass","title":"JetBrains YouTrack authorization bypass in scripts debugger","severity":"high","exploited":false,"published_at":"2026-09-30T16:16:58.72+00:00","url":"https://junglewise.ai/threats/cve-2026-100273-in-jetbrains-youtrack-before-2026-2-19197-authorisation-bypass"},{"cve":"CVE-2026-103493","cvss":8.1,"epss":0.0022,"slug":"cve-2026-103493-in-jetbrains-youtrack-before-2026-2-19422-stored-xss-via-mermaid","title":"JetBrains YouTrack stored XSS in Mermaid and LaTeX","severity":"high","exploited":false,"published_at":"2026-10-01T10:17:14.78+00:00","url":"https://junglewise.ai/threats/cve-2026-103493-in-jetbrains-youtrack-before-2026-2-19422-stored-xss-via-mermaid"}],"high":7,"name":"Jetbrains YouTrack","rank":14,"slug":"youtrack","score":42,"vendor":{"name":"Jetbrains","slug":"jetbrains"},"critical":0,"max_cvss":8.9,"max_epss":0.0068,"exploited":0,"vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/youtrack"},{"hub":true,"top":[{"cve":"CVE-2026-103255","cvss":9,"epss":0.003,"slug":"cve-2026-103255-n8n-versions-before-1-123-80-from-2-0-0-before-2-39-6-and-from-2","title":"n8n path traversal in Supabase node","severity":"critical","exploited":false,"published_at":"2026-10-01T11:17:19.717+00:00","url":"https://junglewise.ai/threats/cve-2026-103255-n8n-versions-before-1-123-80-from-2-0-0-before-2-39-6-and-from-2"},{"cve":"CVE-2026-103248","cvss":9,"epss":0.003,"slug":"cve-2026-103248-n8n-versions-before-1-123-80-from-2-0-0-before-2-39-6-and-from-2","title":"n8n Supabase node filter injection in Filters (String) mode","severity":"critical","exploited":false,"published_at":"2026-10-01T11:17:18.257+00:00","url":"https://junglewise.ai/threats/cve-2026-103248-n8n-versions-before-1-123-80-from-2-0-0-before-2-39-6-and-from-2"},{"cve":"CVE-2026-103253","cvss":8.7,"epss":0.0023,"slug":"cve-2026-103253-n8n-versions-before-1-123-80-from-2-0-0-before-2-39-6-and-from-2","title":"n8n SQL injection in Oracle Database node Delete Table operation","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:19.343+00:00","url":"https://junglewise.ai/threats/cve-2026-103253-n8n-versions-before-1-123-80-from-2-0-0-before-2-39-6-and-from-2"}],"high":9,"name":"N8n","rank":15,"slug":"n8n","score":42,"vendor":{"name":"N8n","slug":"n8n"},"critical":2,"max_cvss":9,"max_epss":0.0043,"exploited":0,"vulnerabilities":14,"url":"https://junglewise.ai/threats/technologies/n8n"},{"hub":true,"top":[{"cve":"CVE-2026-71379","cvss":10,"slug":"cve-2026-71379-toptech-tms7-and-tophat","title":"The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:21.56+00:00","url":"https://junglewise.ai/threats/cve-2026-71379-toptech-tms7-and-tophat"},{"cve":"CVE-2026-70356","cvss":9.1,"slug":"cve-2026-70356-the-tms-file-upload-endpoint-fails-to-enforce-server-side-file","title":"Toptech TMS7 unrestricted file upload in file endpoint","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:16.14+00:00","url":"https://junglewise.ai/threats/cve-2026-70356-the-tms-file-upload-endpoint-fails-to-enforce-server-side-file"},{"cve":"CVE-2026-72510","cvss":9,"slug":"cve-2026-72510-the-supplier-no-parameter-used-in-the-business-allocation-search","title":"Toptech TMS7 and TopHAT SQL injection in business allocation search","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:22.607+00:00","url":"https://junglewise.ai/threats/cve-2026-72510-the-supplier-no-parameter-used-in-the-business-allocation-search"}],"high":1,"name":"Toptech Systems TopHAT","rank":16,"slug":"toptech-systems-tophat","score":39,"vendor":{"name":"Toptech Systems","slug":"toptech-systems"},"critical":6,"max_cvss":10,"max_epss":null,"exploited":0,"vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/toptech-systems-tophat"},{"hub":false,"top":[{"cve":"CVE-2026-103283","cvss":8.1,"epss":0.0027,"slug":"cve-2026-103283-ghost-versions-6-20-0-before-6-57-1-contain-a-session-handling","title":"Ghost session handling authentication bypass via user impersonation","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:24.397+00:00","url":"https://junglewise.ai/threats/cve-2026-103283-ghost-versions-6-20-0-before-6-57-1-contain-a-session-handling"},{"cve":"CVE-2026-103277","cvss":8.1,"epss":0.0027,"slug":"cve-2026-103277-ghost-versions-from-2-5-0-before-6-34-0-contain-an-untrusted","title":"Ghost oEmbed preview script injection vulnerability","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:23.403+00:00","url":"https://junglewise.ai/threats/cve-2026-103277-ghost-versions-from-2-5-0-before-6-34-0-contain-an-untrusted"},{"cve":"CVE-2026-103292","cvss":8,"epss":0.0023,"slug":"cve-2026-103292-ghost-versions-from-0-5-3-through-versions-prior-to-6-50-0-fail","title":"Ghost JSON-LD cross-site scripting in ghost_head helper","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:25.847+00:00","url":"https://junglewise.ai/threats/cve-2026-103292-ghost-versions-from-0-5-3-through-versions-prior-to-6-50-0-fail"}],"high":7,"name":"TryGhost Ghost","rank":17,"slug":"tryghost-ghost","score":35,"vendor":{"name":"TryGhost","slug":"tryghost"},"critical":0,"max_cvss":8.1,"max_epss":0.0065,"exploited":0,"vulnerabilities":21},{"hub":true,"top":[{"cve":"CVE-2026-105207","cvss":9.8,"epss":0.0031,"slug":"cve-2026-105207-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-17-3-creates","title":"ZITADEL account takeover via external identity provider linking","severity":"critical","exploited":false,"published_at":"2026-10-04T15:16:31.677+00:00","url":"https://junglewise.ai/threats/cve-2026-105207-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-17-3-creates"},{"cve":"CVE-2026-105209","cvss":9.6,"epss":0.0022,"slug":"cve-2026-105209-zitadel-3-x-before-3-4-15-and-4-x-before-4-17-1-contains-an","title":"ZITADEL improper authorization in passkey and passwordless enrollment","severity":"critical","exploited":false,"published_at":"2026-10-04T15:16:32.007+00:00","url":"https://junglewise.ai/threats/cve-2026-105209-zitadel-3-x-before-3-4-15-and-4-x-before-4-17-1-contains-an"},{"cve":"CVE-2026-105215","cvss":9.1,"epss":0.0034,"slug":"cve-2026-105215-zitadel-before-3-4-14-and-4-x-before-4-16-2-contains-an","title":"ZITADEL authentication bypass in Login V1 UI","severity":"critical","exploited":false,"published_at":"2026-10-04T15:16:32.993+00:00","url":"https://junglewise.ai/threats/cve-2026-105215-zitadel-before-3-4-14-and-4-x-before-4-16-2-contains-an"}],"high":5,"name":"ZITADEL","rank":18,"slug":"zitadel","score":35,"vendor":{"name":"ZITADEL","slug":"zitadel"},"critical":3,"max_cvss":9.8,"max_epss":0.0034,"exploited":0,"vulnerabilities":10,"url":"https://junglewise.ai/threats/technologies/zitadel"},{"hub":true,"top":[{"slug":"trigger-dev-v1-coordinator-default-secret-unauth-socket-io-232d6390","title":"Trigger.dev V1 coordinator default-secret unauthenticated access","severity":"critical","exploited":false,"published_at":"2026-10-02T22:39:00+00:00","url":"https://junglewise.ai/threats/trigger-dev-v1-coordinator-default-secret-unauth-socket-io-232d6390"},{"cvss":7.7,"slug":"trigger-dev-cross-tenant-sql-injection-in-the-tsql-query-compiler-post-98af5ddc","title":"Trigger.dev cross-tenant SQL injection in TSQL query compiler","severity":"high","exploited":false,"published_at":"2026-10-02T22:42:20+00:00","url":"https://junglewise.ai/threats/trigger-dev-cross-tenant-sql-injection-in-the-tsql-query-compiler-post-98af5ddc"},{"cvss":7.7,"slug":"cve-2026-85650-trigger-dev-server-side-request-forgery-in-webhook-alert-delivery","title":"Trigger.dev server-side request forgery in webhook alert channel","severity":"high","exploited":false,"published_at":"2026-10-02T19:31:33+00:00","url":"https://junglewise.ai/threats/cve-2026-85650-trigger-dev-server-side-request-forgery-in-webhook-alert-delivery"}],"high":5,"name":"trigger.dev (npm)","rank":19,"slug":"npm-trigger-dev","score":33,"vendor":{"name":"npm","slug":"npm"},"critical":1,"max_cvss":7.7,"max_epss":null,"exploited":0,"vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/npm-trigger-dev"},{"hub":true,"top":[{"cve":"CVE-2026-103110","cvss":9.8,"slug":"cve-2026-103110-pexip-infinity-before-38-2-plus-39-0-39-1-and-40-0-is-affected","title":"Pexip Infinity remote code execution via improper input validation","severity":"critical","exploited":false,"published_at":"2026-09-30T04:18:29.077+00:00","url":"https://junglewise.ai/threats/cve-2026-103110-pexip-infinity-before-38-2-plus-39-0-39-1-and-40-0-is-affected"},{"cve":"CVE-2026-103105","cvss":8.8,"slug":"cve-2026-103105-pexip-infinity-before-38-2-plus-39-0-39-1-and-40-0-is-affected","title":"Pexip Infinity improper access control on internal API","severity":"high","exploited":false,"published_at":"2026-09-30T03:16:59.623+00:00","url":"https://junglewise.ai/threats/cve-2026-103105-pexip-infinity-before-38-2-plus-39-0-39-1-and-40-0-is-affected"},{"cve":"CVE-2026-103102","cvss":8.6,"slug":"cve-2026-103102-pexip-infinity-before-41-0-is-affected-by-improper-input","title":"Pexip Infinity improper input validation in signaling","severity":"high","exploited":false,"published_at":"2026-09-30T03:16:59.307+00:00","url":"https://junglewise.ai/threats/cve-2026-103102-pexip-infinity-before-41-0-is-affected-by-improper-input"}],"high":9,"name":"Pexip Infinity","rank":20,"slug":"infinity","score":33,"vendor":{"name":"Pexip","slug":"pexip"},"critical":1,"max_cvss":9.8,"max_epss":null,"exploited":0,"vulnerabilities":10,"url":"https://junglewise.ai/threats/technologies/infinity"},{"hub":true,"top":[{"cve":"CVE-2026-101077","cvss":10,"slug":"cve-2026-101077-a-flaw-has-been-found-in-netcore-nr289-ge-1-4-5102-this-impacts","title":"Netcore NR289-GE authentication bypass in boa web server","severity":"critical","exploited":false,"published_at":"2026-09-28T16:17:12.143+00:00","url":"https://junglewise.ai/threats/cve-2026-101077-a-flaw-has-been-found-in-netcore-nr289-ge-1-4-5102-this-impacts"},{"cve":"CVE-2026-101076","cvss":10,"slug":"cve-2026-101076-a-vulnerability-was-detected-in-netcore-nr289-ge-1-4-5102-this","title":"Netcore NR289-GE OS command injection in NTP handler","severity":"critical","exploited":false,"published_at":"2026-09-28T16:17:11.947+00:00","url":"https://junglewise.ai/threats/cve-2026-101076-a-vulnerability-was-detected-in-netcore-nr289-ge-1-4-5102-this"},{"cve":"CVE-2026-101075","cvss":10,"slug":"cve-2026-101075-a-security-vulnerability-has-been-detected-in-netcore-nr289-ge-1","title":"Netcore NR289-GE OS command injection in location_time.cgi","severity":"critical","exploited":false,"published_at":"2026-09-28T15:17:13.043+00:00","url":"https://junglewise.ai/threats/cve-2026-101075-a-security-vulnerability-has-been-detected-in-netcore-nr289-ge-1"}],"high":1,"name":"Netcore NR289-GE","rank":21,"slug":"nr289-ge","score":33,"vendor":{"name":"Netcore","slug":"netcore"},"critical":5,"max_cvss":10,"max_epss":null,"exploited":0,"vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/nr289-ge"},{"hub":true,"top":[{"cve":"CVE-2026-47600","cvss":7.8,"slug":"cve-2026-47600-nvidia-gpu-display-driver-for-windows-and-linux-contains-a","title":"NVIDIA GPU Display Driver kernel mode error-handling code execution","severity":"high","exploited":false,"published_at":"2026-09-30T16:17:30.4+00:00","url":"https://junglewise.ai/threats/cve-2026-47600-nvidia-gpu-display-driver-for-windows-and-linux-contains-a"},{"cve":"CVE-2026-47597","cvss":7.8,"slug":"cve-2026-47597-nvidia-gpu-display-driver-for-windows-and-linux-contains-a","title":"NVIDIA GPU Display Driver use-after-free in Resource Server","severity":"high","exploited":false,"published_at":"2026-09-30T16:17:29.963+00:00","url":"https://junglewise.ai/threats/cve-2026-47597-nvidia-gpu-display-driver-for-windows-and-linux-contains-a"},{"cve":"CVE-2026-47570","cvss":7.8,"slug":"cve-2026-47570-nvidia-gpu-display-driver-for-windows-contains-a-vulnerability-in","title":"NVIDIA GPU Display Driver Windows DLL injection via uncontrolled search path","severity":"high","exploited":false,"published_at":"2026-09-30T16:17:25.97+00:00","url":"https://junglewise.ai/threats/cve-2026-47570-nvidia-gpu-display-driver-for-windows-contains-a-vulnerability-in"}],"high":9,"name":"Nvidia GPU Display Driver for Windows","rank":22,"slug":"gpu-display-driver-for-windows","score":32,"vendor":{"name":"Nvidia","slug":"nvidia"},"critical":0,"max_cvss":7.8,"max_epss":null,"exploited":0,"vulnerabilities":14,"url":"https://junglewise.ai/threats/technologies/gpu-display-driver-for-windows"},{"hub":true,"top":[{"cve":"CVE-2026-102490","epss":0.0026,"slug":"cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the","title":"Zammad privilege escalation to root","severity":"critical","exploited":true,"published_at":"2026-09-30T17:16:40.707+00:00","url":"https://junglewise.ai/threats/cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the"},{"cve":"CVE-2026-102489","epss":0.0058,"slug":"cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack","title":"Zammad session hijack leading to remote code execution","severity":"critical","exploited":true,"published_at":"2026-09-30T17:16:40.55+00:00","url":"https://junglewise.ai/threats/cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack"}],"high":0,"name":"Zammad","rank":23,"slug":"zammad","score":32,"vendor":{"name":"Zammad","slug":"zammad"},"critical":2,"max_cvss":null,"max_epss":0.0058,"exploited":2,"vulnerabilities":2,"url":"https://junglewise.ai/threats/technologies/zammad"},{"hub":false,"top":[{"cve":"CVE-2026-102490","epss":0.0026,"slug":"cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the","title":"Zammad privilege escalation to root","severity":"critical","exploited":true,"published_at":"2026-09-30T17:16:40.707+00:00","url":"https://junglewise.ai/threats/cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the"},{"cve":"CVE-2026-102489","epss":0.0058,"slug":"cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack","title":"Zammad session hijack leading to remote code execution","severity":"critical","exploited":true,"published_at":"2026-09-30T17:16:40.55+00:00","url":"https://junglewise.ai/threats/cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack"}],"high":0,"name":"Zammad Gmbh Zammad","rank":24,"slug":"zammad-gmbh-zammad","score":32,"vendor":{"name":"Zammad Gmbh","slug":"zammad-gmbh"},"critical":2,"max_cvss":null,"max_epss":0.0058,"exploited":2,"vulnerabilities":2},{"hub":false,"top":[{"cve":"CVE-2026-82829","cvss":9.8,"epss":0.0029,"slug":"cve-2026-82829-hitachi-coding-software-suite-contains-a-vulnerability-related-to","title":"Hitachi Coding Software Suite hidden functionality authentication bypass","severity":"critical","exploited":false,"published_at":"2026-10-01T05:17:11.09+00:00","url":"https://junglewise.ai/threats/cve-2026-82829-hitachi-coding-software-suite-contains-a-vulnerability-related-to"},{"cve":"CVE-2026-82827","cvss":9.8,"epss":0.0027,"slug":"cve-2026-82827-hitachi-coding-software-suite-contains-a-vulnerability-related-to","title":"Hitachi Coding Software Suite hardcoded JWT key","severity":"critical","exploited":false,"published_at":"2026-10-01T05:17:10.78+00:00","url":"https://junglewise.ai/threats/cve-2026-82827-hitachi-coding-software-suite-contains-a-vulnerability-related-to"},{"cve":"CVE-2026-82825","cvss":9.8,"epss":0.0034,"slug":"cve-2026-82825-hitachi-coding-software-suite-contains-a-vulnerability-related-to","title":"Hitachi Coding Software Suite missing authentication in critical API","severity":"critical","exploited":false,"published_at":"2026-10-01T05:17:10.443+00:00","url":"https://junglewise.ai/threats/cve-2026-82825-hitachi-coding-software-suite-contains-a-vulnerability-related-to"}],"high":2,"name":"Hitachi Coding Software Suite","rank":25,"slug":"coding-software-suite","score":30,"vendor":{"name":"Hitachi","slug":"hitachi"},"critical":4,"max_cvss":9.8,"max_epss":0.0038,"exploited":0,"vulnerabilities":6}],"previous":{"key":"2026-09-21","top":"Linux Kernel","period":{"end":"2026-09-27","start":"2026-09-21"},"totals":{"high":892,"tracked":58557,"critical":192,"exploited":6,"technologies":1253,"vulnerabilities":2950},"url":"https://junglewise.ai/threats/weekly/2026-09-21"},"next":{"key":"2026-10-05","top":"Google Chrome","period":{"end":"2026-10-11","start":"2026-10-05"},"totals":{"high":424,"tracked":6710,"critical":93,"exploited":3,"technologies":959,"vulnerabilities":1789},"url":"https://junglewise.ai/threats/weekly/2026-10-05"}}