Weekly report
Most vulnerable technologies: week of 5 to 11 October 2026 (week 41)
Final report, published . It does not change.
In the week of 5 to 11 October 2026, Junglewise Threat Intelligence recorded 1,789 new vulnerabilities: 93 critical, 424 high and 3 exploited in the wild. The most vulnerable technology was Google Chrome, with 247 vulnerabilities (0 critical), followed by Linux Kernel (203) and IBM Langflow (24).
- New vulnerabilities
- 1,789
- Critical
- 93
- Exploited in the wild
- 3
- Technologies affected
- 959
Ranking
Most affected vendors
- 1.Google284 vulnerabilities, 0 critical, 0 exploited
- 2.Linux189 vulnerabilities, 0 critical, 0 exploited
- 3.Dell22 vulnerabilities, 7 critical, 0 exploited
- 4.Hpe22 vulnerabilities, 8 critical, 0 exploited
- 5.IBM27 vulnerabilities, 2 critical, 0 exploited
- 6.Arista24 vulnerabilities, 3 critical, 0 exploited
- 7.Backstage33 vulnerabilities, 1 critical, 0 exploited
- 8.Payload CMS19 vulnerabilities, 5 critical, 0 exploited
- 9.Plane25 vulnerabilities, 4 critical, 0 exploited
- 10.MediaTek31 vulnerabilities, 0 critical, 0 exploited
Most severe vulnerabilities
- CVE-2015-3306: ProFTPD improper access control in SITE commandscriticalexploited in the wildEPSS 96.8%
- CVE-2015-5477: ISC BIND denial of service via TKEY queriescriticalexploited in the wildEPSS 91.3%
- CVE-2021-3199: ONLYOFFICE Docs Server path traversal in image uploadcriticalexploited in the wildEPSS 8.2%
- CVE-2026-105285: Totolink A3002MU stack buffer overflow in QoS handlercriticalCVSS 10EPSS 1.1%
- CVE-2026-105284: Totolink A3002MU authentication bypass in bin/boacriticalCVSS 10EPSS 0.8%
- CVE-2026-105857: Payload plugin-form-builder remote code executioncriticalCVSS 10EPSS 0.4%
- CVE-2026-106102: Quasar Framework SSR meta serialization XSScriticalCVSS 10EPSS 0.3%
- CVE-2026-63692: Dell Container Storage Modules missing authentication in gRPC servicescriticalCVSS 10
- CVE-2026-63688: Dell Container Storage Modules missing authentication in gRPC servercriticalCVSS 10
- CVE-2026-39773: WordPress Doctreat Core privilege escalationcriticalCVSS 10
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
Technologies are ranked by a score: 10 points for each vulnerability exploited in the wild, 5 for each critical, 2 for each high and 1 for every vulnerability. A vulnerability counts once for every technology it affects, so one advisory can appear under several products.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/weekly/2026-10-05.json, and this page as text at https://junglewise.ai/threats/weekly/2026-10-05.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 5 to 11 October 2026 (week 41)", https://junglewise.ai/threats/weekly/2026-10-05, 13 October 2026.