# Most vulnerable technologies: week of 28 September to 4 October 2026 (week 40)

Source: https://junglewise.ai/threats/weekly/2026-09-28  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 6 October 2026, 00:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-09-28.json  
License: CC BY 4.0 with a link back

In the week of 28 September to 4 October 2026, Junglewise Threat Intelligence recorded 2,669 new vulnerabilities: 209 critical, 851 high and 6 exploited in the wild. The most vulnerable technology was Google Chrome, with 152 vulnerabilities (24 critical), followed by Mozilla Firefox (75) and NVIDIA GPU Display Driver (73).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 152 | 24 | 42 | 0 | 9.6 |
| 2 | [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox) (Mozilla) | 75 | 9 | 32 | 0 | 9.6 |
| 3 | [NVIDIA GPU Display Driver](https://junglewise.ai/threats/technologies/gpu-display-driver) (Nvidia) | 73 | 0 | 45 | 0 | 7.8 |
| 4 | [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr) (Mozilla) | 62 | 8 | 27 | 0 | 9.6 |
| 5 | [Kiteworks Core](https://junglewise.ai/threats/technologies/kiteworks-core) (Kiteworks) | 33 | 2 | 18 | 0 | 9.8 |
| 6 | [Kiteworks Email Protection Gateway](https://junglewise.ai/threats/technologies/email-protection-gateway) (Kiteworks) | 22 | 7 | 11 | 0 | 9.4 |
| 7 | [YesWiki](https://junglewise.ai/threats/technologies/yeswiki) (YesWiki) | 37 | 0 | 14 | 0 | 8.6 |
| 8 | [Apache Thrift](https://junglewise.ai/threats/technologies/thrift) (Apache) | 60 | 0 | 0 | 0 | n/a |
| 9 | [Nvidia GPU Display Driver for Linux](https://junglewise.ai/threats/technologies/gpu-display-driver-for-linux) (Nvidia) | 22 | 0 | 14 | 0 | 7.8 |
| 10 | [Apache HTTP Server](https://junglewise.ai/threats/technologies/http-server) (Apache) | 16 | 3 | 9 | 0 | 9.8 |
| 11 | [Ziroom ZHOME A0101](https://junglewise.ai/threats/technologies/zhome-a0101) (Ziroom) | 8 | 8 | 0 | 0 | 9.1 |
| 12 | [Apache Roller](https://junglewise.ai/threats/technologies/roller) (Apache) | 18 | 3 | 7 | 0 | 9.9 |
| 13 | [Toptech Systems TMS7](https://junglewise.ai/threats/technologies/tms7) (Toptech Systems) | 8 | 7 | 1 | 0 | 10 |
| 14 | [Jetbrains YouTrack](https://junglewise.ai/threats/technologies/youtrack) (Jetbrains) | 28 | 0 | 7 | 0 | 8.9 |
| 15 | [N8n](https://junglewise.ai/threats/technologies/n8n) (N8n) | 14 | 2 | 9 | 0 | 9 |
| 16 | [Toptech Systems TopHAT](https://junglewise.ai/threats/technologies/toptech-systems-tophat) (Toptech Systems) | 7 | 6 | 1 | 0 | 10 |
| 17 | TryGhost Ghost (TryGhost) | 21 | 0 | 7 | 0 | 8.1 |
| 18 | [ZITADEL](https://junglewise.ai/threats/technologies/zitadel) (ZITADEL) | 10 | 3 | 5 | 0 | 9.8 |
| 19 | [trigger.dev (npm)](https://junglewise.ai/threats/technologies/npm-trigger-dev) (npm) | 18 | 1 | 5 | 0 | 7.7 |
| 20 | [Pexip Infinity](https://junglewise.ai/threats/technologies/infinity) (Pexip) | 10 | 1 | 9 | 0 | 9.8 |
| 21 | [Netcore NR289-GE](https://junglewise.ai/threats/technologies/nr289-ge) (Netcore) | 6 | 5 | 1 | 0 | 10 |
| 22 | [Nvidia GPU Display Driver for Windows](https://junglewise.ai/threats/technologies/gpu-display-driver-for-windows) (Nvidia) | 14 | 0 | 9 | 0 | 7.8 |
| 23 | [Zammad](https://junglewise.ai/threats/technologies/zammad) (Zammad) | 2 | 2 | 0 | 2 | n/a |
| 24 | Zammad Gmbh Zammad (Zammad Gmbh) | 2 | 2 | 0 | 2 | n/a |
| 25 | Hitachi Coding Software Suite (Hitachi) | 6 | 4 | 2 | 0 | 9.8 |

## Most affected vendors

1. [Google](https://junglewise.ai/threats/vendors/google): 162 vulnerabilities, 24 critical, 0 exploited
2. [Nvidia](https://junglewise.ai/threats/vendors/nvidia): 116 vulnerabilities, 0 critical, 0 exploited
3. [Apache](https://junglewise.ai/threats/vendors/apache): 151 vulnerabilities, 10 critical, 0 exploited
4. [Mozilla](https://junglewise.ai/threats/vendors/mozilla): 79 vulnerabilities, 9 critical, 0 exploited
5. [Kiteworks](https://junglewise.ai/threats/vendors/kiteworks): 60 vulnerabilities, 9 critical, 0 exploited
6. [YesWiki](https://junglewise.ai/threats/vendors/yeswiki): 36 vulnerabilities, 0 critical, 0 exploited
7. [Netcore](https://junglewise.ai/threats/vendors/netcore): 11 vulnerabilities, 9 critical, 0 exploited
8. [Jetbrains](https://junglewise.ai/threats/vendors/jetbrains): 34 vulnerabilities, 0 critical, 0 exploited
9. [Ziroom](https://junglewise.ai/threats/vendors/ziroom): 9 vulnerabilities, 9 critical, 0 exploited
10. [Hpe](https://junglewise.ai/threats/vendors/hpe): 18 vulnerabilities, 5 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-104286: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail…](https://junglewise.ai/threats/cve-2026-104286-fortinet-fortimail-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 1 Oct 2026)
- [CVE-2026-76504: Cisco Catalyst SD-WAN Manager API authentication bypass](https://junglewise.ai/threats/cve-2026-76504-a-vulnerability-in-the-api-session-based-authentication) (critical, exploited in the wild, CVSS 9.8, published 30 Sep 2026)
- [CVE-2026-86950: Apple CoreGraphics out-of-bounds write in file processing](https://junglewise.ai/threats/cve-2026-86950-an-out-of-bounds-write-issue-was-addressed-with-improved-bounds) (critical, exploited in the wild, CVSS 8.8, published 28 Sep 2026)
- [CVE-2026-88779: Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before…](https://junglewise.ai/threats/cve-2026-88779-cisa-adds-one-known-exploited-vulnerability-to-catalog) (critical, exploited in the wild, CVSS 7.5, published 4 Oct 2026)
- [CVE-2026-102489: Zammad session hijack leading to remote code execution](https://junglewise.ai/threats/cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack) (critical, exploited in the wild, published 30 Sep 2026)
- [CVE-2026-102490: Zammad privilege escalation to root](https://junglewise.ai/threats/cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the) (critical, exploited in the wild, published 30 Sep 2026)
- [CVE-2026-105134: Ahsay AhsayCBS OS command injection in UpdateReceivers](https://junglewise.ai/threats/cve-2026-105134-a-flaw-has-been-found-in-ahsay-ahsaycbs-up-to-10-3-2-this) (critical, CVSS 10, published 4 Oct 2026)
- [CVE-2026-105135: InternLM MindSearch code injection in planner agent](https://junglewise.ai/threats/cve-2026-105135-a-vulnerability-has-been-found-in-internlm-mindsearch-0-1-0-this) (critical, CVSS 10, published 4 Oct 2026)
- [CVE-2026-104610: Tenda HG7/HG9/HG10 stack buffer overflow in formLoopBack](https://junglewise.ai/threats/cve-2026-104610-a-security-vulnerability-has-been-detected-in-tenda-hg7-hg9-and) (critical, CVSS 10, published 2 Oct 2026)
- [CVE-2026-103956: Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote…](https://junglewise.ai/threats/cve-2026-103956-and-issues-in-loom-for-aws) (critical, CVSS 10, published 2 Oct 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 28 September to 4 October 2026 (week 40)", https://junglewise.ai/threats/weekly/2026-09-28, 6 October 2026.