# Most vulnerable technologies: week of 5 to 11 October 2026 (week 41)

Source: https://junglewise.ai/threats/weekly/2026-10-05  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 13 October 2026, 00:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-10-05.json  
License: CC BY 4.0 with a link back

In the week of 5 to 11 October 2026, Junglewise Threat Intelligence recorded 1,789 new vulnerabilities: 93 critical, 424 high and 3 exploited in the wild. The most vulnerable technology was Google Chrome, with 247 vulnerabilities (0 critical), followed by Linux Kernel (203) and IBM Langflow (24).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 247 | 0 | 0 | 0 | n/a |
| 2 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 203 | 0 | 1 | 0 | 7 |
| 3 | [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss) (IBM) | 24 | 2 | 18 | 0 | 9.8 |
| 4 | [Plane](https://junglewise.ai/threats/technologies/plane-plane) (Plane) | 25 | 4 | 8 | 0 | 9.9 |
| 5 | [Payload CMS Payload](https://junglewise.ai/threats/technologies/payload-cms-payload) (Payload CMS) | 16 | 5 | 8 | 0 | 9.8 |
| 6 | [payload (npm)](https://junglewise.ai/threats/technologies/payload) (npm) | 18 | 3 | 10 | 0 | 9.8 |
| 7 | [Arista CloudVision Portal](https://junglewise.ai/threats/technologies/cloudvision-portal) (Arista) | 17 | 2 | 9 | 0 | 9.8 |
| 8 | [Dell Container Storage Modules](https://junglewise.ai/threats/technologies/container-storage-modules) (Dell) | 11 | 5 | 4 | 0 | 10 |
| 9 | [Hpe ClearPass Policy Manager](https://junglewise.ai/threats/technologies/hpe-clearpass-policy-manager) (Hpe) | 12 | 4 | 4 | 0 | 9.8 |
| 10 | [ghost (npm)](https://junglewise.ai/threats/technologies/ghost) (npm) | 20 | 0 | 8 | 0 | 8.8 |
| 11 | [Makeplane Plane](https://junglewise.ai/threats/technologies/plane) (Makeplane) | 12 | 2 | 7 | 0 | 9.6 |
| 12 | [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api) (Go) | 24 | 0 | 5 | 0 | 8.1 |
| 13 | [github.com/xuri/excelize/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-xuri-excelize-v2) (Go) | 15 | 0 | 9 | 0 | 7.5 |
| 14 | [github.com/0xJacky/Nginx-UI (Go)](https://junglewise.ai/threats/technologies/github-com-0xjacky-nginx-ui) (Go) | 10 | 1 | 8 | 0 | 8.8 |
| 15 | [Gitea](https://junglewise.ai/threats/technologies/gitea) (Gitea) | 30 | 0 | 0 | 0 | n/a |
| 16 | [Google Android](https://junglewise.ai/threats/technologies/android) (Google) | 27 | 0 | 1 | 0 | 7.5 |
| 17 | [Vikunja](https://junglewise.ai/threats/technologies/vikunja) (Vikunja) | 19 | 0 | 5 | 0 | 8.1 |
| 18 | [Amazon AWS](https://junglewise.ai/threats/technologies/aws) (Amazon) | 8 | 1 | 7 | 0 | 9 |
| 19 | [pyload-ng (PyPI)](https://junglewise.ai/threats/technologies/pyload-ng) (PyPI) | 16 | 0 | 5 | 0 | 8.1 |
| 20 | [github.com/corazawaf/coraza/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-corazawaf-coraza-v3) (Go) | 20 | 0 | 2 | 0 | 7.5 |
| 21 | [Aruba ClearPass Policy Manager](https://junglewise.ai/threats/technologies/aruba-clearpass-policy-manager) (Aruba) | 5 | 3 | 2 | 0 | 9.8 |
| 22 | [Ghost](https://junglewise.ai/threats/technologies/ghost-ghost) (Ghost) | 11 | 0 | 6 | 0 | 8.1 |
| 23 | [SixLabors ImageSharp](https://junglewise.ai/threats/technologies/imagesharp) (SixLabors) | 9 | 0 | 6 | 0 | 7.5 |
| 24 | [Kishor-23 Food-Waste-Management-System](https://junglewise.ai/threats/technologies/food-waste-management-system) (Kishor-23) | 9 | 0 | 6 | 0 | 7.3 |
| 25 | [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow) (PyPI) | 7 | 2 | 2 | 0 | 9.9 |

## Most affected vendors

1. [Google](https://junglewise.ai/threats/vendors/google): 284 vulnerabilities, 0 critical, 0 exploited
2. [Linux](https://junglewise.ai/threats/vendors/linux): 189 vulnerabilities, 0 critical, 0 exploited
3. [Dell](https://junglewise.ai/threats/vendors/dell): 22 vulnerabilities, 7 critical, 0 exploited
4. [Hpe](https://junglewise.ai/threats/vendors/hpe): 22 vulnerabilities, 8 critical, 0 exploited
5. [IBM](https://junglewise.ai/threats/vendors/ibm): 27 vulnerabilities, 2 critical, 0 exploited
6. [Arista](https://junglewise.ai/threats/vendors/arista): 24 vulnerabilities, 3 critical, 0 exploited
7. [Backstage](https://junglewise.ai/threats/vendors/backstage): 33 vulnerabilities, 1 critical, 0 exploited
8. [Payload CMS](https://junglewise.ai/threats/vendors/payload-cms): 19 vulnerabilities, 5 critical, 0 exploited
9. [Plane](https://junglewise.ai/threats/vendors/plane): 25 vulnerabilities, 4 critical, 0 exploited
10. [MediaTek](https://junglewise.ai/threats/vendors/mediatek): 31 vulnerabilities, 0 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2015-3306: ProFTPD improper access control in SITE commands](https://junglewise.ai/threats/cve-2015-3306-proftpd-improper-access-control-vulnerability) (critical, exploited in the wild, published 8 Oct 2026)
- [CVE-2015-5477: ISC BIND denial of service via TKEY queries](https://junglewise.ai/threats/cve-2015-5477-isc-bind-data-processing-errors-vulnerability) (critical, exploited in the wild, published 8 Oct 2026)
- [CVE-2021-3199: ONLYOFFICE Docs Server path traversal in image upload](https://junglewise.ai/threats/cve-2021-3199-onlyoffice-docs-server-path-traversal-vulnerability) (critical, exploited in the wild, published 8 Oct 2026)
- [CVE-2026-105285: Totolink A3002MU stack buffer overflow in QoS handler](https://junglewise.ai/threats/cve-2026-105285-a-security-vulnerability-has-been-detected-in-totolink-a3002mu-1) (critical, CVSS 10, published 5 Oct 2026)
- [CVE-2026-105284: Totolink A3002MU authentication bypass in bin/boa](https://junglewise.ai/threats/cve-2026-105284-a-weakness-has-been-identified-in-totolink-a3002mu-1-0-0) (critical, CVSS 10, published 5 Oct 2026)
- [CVE-2026-105857: Payload plugin-form-builder remote code execution](https://junglewise.ai/threats/cve-2026-105857-payload-is-a-free-and-open-source-headless-content-management) (critical, CVSS 10, published 6 Oct 2026)
- [CVE-2026-106102: Quasar Framework SSR meta serialization XSS](https://junglewise.ai/threats/cve-2026-106102-quasar-framework-is-a-framework-for-building-high-performance) (critical, CVSS 10, published 6 Oct 2026)
- [CVE-2026-63692: Dell Container Storage Modules missing authentication in gRPC services](https://junglewise.ai/threats/cve-2026-63692-dell-container-storage-modules-versions-prior-to-1-18-0-contain-s) (critical, CVSS 10, published 6 Oct 2026)
- [CVE-2026-63688: Dell Container Storage Modules missing authentication in gRPC server](https://junglewise.ai/threats/cve-2026-63688-dell-container-storage-modules-csm-versions-prior-to-v1-18-0) (critical, CVSS 10, published 6 Oct 2026)
- [CVE-2026-39773: WordPress Doctreat Core privilege escalation](https://junglewise.ai/threats/cve-2026-39773-unauthenticated-privilege-escalation-in-doctreat-core-1-7-0) (critical, CVSS 10, published 6 Oct 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 5 to 11 October 2026 (week 41)", https://junglewise.ai/threats/weekly/2026-10-05, 13 October 2026.