Weekly report
Most vulnerable technologies: week of 12 to 18 October 2026 (week 42)
Final report, published . It does not change.
In the week of 12 to 18 October 2026, Junglewise Threat Intelligence recorded 4,638 new vulnerabilities: 274 critical, 1,770 high and 5 exploited in the wild. The most vulnerable technology was Microsoft Windows, with 618 vulnerabilities (20 critical, 1 exploited in the wild), followed by Microsoft Windows Server 2025 (212) and Microsoft Windows 11 26h2 (197).
- New vulnerabilities
- 4,638
- Critical
- 274
- Exploited in the wild
- 5
- Technologies affected
- 2,047
Ranking
Most affected vendors
- 1.Microsoft1,159 vulnerabilities, 47 critical, 1 exploited
- 2.Linux442 vulnerabilities, 0 critical, 0 exploited
- 3.Adobe140 vulnerabilities, 19 critical, 0 exploited
- 4.IBM85 vulnerabilities, 9 critical, 0 exploited
- 5.Juniper Networks48 vulnerabilities, 6 critical, 0 exploited
- 6.Progress55 vulnerabilities, 5 critical, 0 exploited
- 7.Google51 vulnerabilities, 7 critical, 0 exploited
- 8.Frappe93 vulnerabilities, 0 critical, 0 exploited
- 9.Mozilla83 vulnerabilities, 4 critical, 0 exploited
- 10.Siemens33 vulnerabilities, 4 critical, 0 exploited
Most severe vulnerabilities
- CVE-2026-102764: BeyondTrust Remote Support authentication bypass by spoofingcriticalexploited in the wildCVSS 9.8EPSS 0.6%
- CVE-2026-96951: Microsoft Windows command injection in Shellcriticalexploited in the wildCVSS 8.8EPSS 1.5%
- CVE-2026-104935: Ivanti Connect Secure authentication bypass by spoofingcriticalexploited in the wildCVSS 8.6EPSS 26.0%
- CVE-2026-0322: Palo Alto Networks PAN-OS code injection vulnerabilitycriticalexploited in the wild
- CVE-2026-76519: Cisco Secure Email Gateway relative path traversalcriticalexploited in the wild
- CVE-2026-108804: TRENDnet TEW-751DR/TEW-752DRU/TEW-733GR OS command injection in web managementcriticalCVSS 10EPSS 2.4%
- CVE-2026-109110: Wavlink WL-WN592AX6 OS command injection in wmapd daemoncriticalCVSS 10EPSS 2.0%
- CVE-2026-108918: Edimax BR-6208AC command injection in /goform/formWlanMPcriticalCVSS 10EPSS 2.0%
- CVE-2026-108917: Edimax BR-6208AC command injection in /goform/formAutoFWupgradecriticalCVSS 10EPSS 2.0%
- CVE-2026-108907: Netcore NR268 authentication bypass in CGI executioncriticalCVSS 10EPSS 1.2%
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
Technologies are ranked by a score: 10 points for each vulnerability exploited in the wild, 5 for each critical, 2 for each high and 1 for every vulnerability. A vulnerability counts once for every technology it affects, so one advisory can appear under several products.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/weekly/2026-10-12.json, and this page as text at https://junglewise.ai/threats/weekly/2026-10-12.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 12 to 18 October 2026 (week 42)", https://junglewise.ai/threats/weekly/2026-10-12, 20 October 2026.