# Most vulnerable technologies: week of 19 to 25 October 2026 (week 43)

Source: https://junglewise.ai/threats/weekly/2026-10-19  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 27 October 2026, 00:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-10-19.json  
License: CC BY 4.0 with a link back

In the week of 19 to 25 October 2026, Junglewise Threat Intelligence recorded 4,321 new vulnerabilities: 267 critical, 1,012 high and 3 exploited in the wild. The most vulnerable technology was Google Chrome, with 353 vulnerabilities (0 critical), followed by Linux Kernel (216) and TOTOLINK X2000r (30).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 353 | 0 | 0 | 0 | n/a |
| 2 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 216 | 0 | 1 | 0 | 7.1 |
| 3 | [TOTOLINK X2000r](https://junglewise.ai/threats/technologies/x2000r) (TOTOLINK) | 30 | 30 | 0 | 0 | 9.1 |
| 4 | [Oracle JD Edwards EnterpriseOne Tools](https://junglewise.ai/threats/technologies/jd-edwards-enterpriseone-tools) (Oracle) | 76 | 2 | 38 | 0 | 9.1 |
| 5 | [Oracle SOA Suite](https://junglewise.ai/threats/technologies/soa-suite) (Oracle) | 27 | 15 | 11 | 0 | 10 |
| 6 | [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow) (PyPI) | 41 | 5 | 23 | 0 | 9.8 |
| 7 | [Oracle MySQL Cluster](https://junglewise.ai/threats/technologies/mysql-cluster) (Oracle) | 79 | 0 | 12 | 0 | 8.8 |
| 8 | [Oracle MySQL Server](https://junglewise.ai/threats/technologies/mysql-server) (Oracle) | 77 | 0 | 11 | 0 | 8.8 |
| 9 | [Oracle Essbase](https://junglewise.ai/threats/technologies/essbase) (Oracle) | 35 | 8 | 11 | 0 | 9.9 |
| 10 | [Oracle PeopleSoft Enterprise PeopleTools](https://junglewise.ai/threats/technologies/peopletools) (Oracle) | 57 | 0 | 12 | 0 | 8.7 |
| 11 | [Oracle Outside In Technology](https://junglewise.ai/threats/technologies/outside-in-technology) (Oracle) | 26 | 2 | 21 | 0 | 9.9 |
| 12 | [Apache Camel](https://junglewise.ai/threats/technologies/camel) (Apache) | 39 | 0 | 14 | 0 | 8.8 |
| 13 | [Python Pillow Pillow](https://junglewise.ai/threats/technologies/python-pillow-pillow) (Python Pillow) | 26 | 2 | 14 | 0 | 9.8 |
| 14 | [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server) (Apache) | 15 | 7 | 6 | 0 | 10 |
| 15 | [Oracle Agile Product Lifecycle Management for Process](https://junglewise.ai/threats/technologies/agile-product-lifecycle-management-for-process) (Oracle) | 21 | 2 | 14 | 0 | 9.3 |
| 16 | [Oracle Solaris](https://junglewise.ai/threats/technologies/solaris) (Oracle) | 23 | 2 | 12 | 0 | 9.8 |
| 17 | [Oracle Siebel CRM Deployment](https://junglewise.ai/threats/technologies/siebel-crm-deployment) (Oracle) | 29 | 0 | 13 | 0 | 8.8 |
| 18 | [Oracle Java SE](https://junglewise.ai/threats/technologies/java-se) (Oracle) | 40 | 2 | 2 | 0 | 9.1 |
| 19 | [Amazon AWS](https://junglewise.ai/threats/technologies/aws) (Amazon) | 11 | 3 | 8 | 1 | 9.9 |
| 20 | [Trigger.dev](https://junglewise.ai/threats/technologies/trigger-dev) (Trigger.dev) | 24 | 0 | 12 | 0 | 8.8 |
| 21 | [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai) (PyPI) | 15 | 1 | 14 | 0 | 9.8 |
| 22 | [Oracle GraalVM Enterprise Edition](https://junglewise.ai/threats/technologies/graalvm-enterprise-edition) (Oracle) | 35 | 2 | 1 | 0 | 9.1 |
| 23 | [Oracle GraalVM for JDK](https://junglewise.ai/threats/technologies/graalvm-for-jdk) (Oracle) | 33 | 2 | 1 | 0 | 9.1 |
| 24 | [Oracle Mobile Field Service](https://junglewise.ai/threats/technologies/mobile-field-service) (Oracle) | 16 | 1 | 12 | 0 | 9.1 |
| 25 | [Oracle Business Intelligence Enterprise Edition](https://junglewise.ai/threats/technologies/business-intelligence-enterprise-edition) (Oracle) | 19 | 1 | 10 | 0 | 9.1 |

## Most affected vendors

1. [Oracle](https://junglewise.ai/threats/vendors/oracle): 987 vulnerabilities, 66 critical, 0 exploited
2. [Google](https://junglewise.ai/threats/vendors/google): 363 vulnerabilities, 1 critical, 1 exploited
3. [Apache](https://junglewise.ai/threats/vendors/apache): 155 vulnerabilities, 7 critical, 0 exploited
4. [Linux](https://junglewise.ai/threats/vendors/linux): 207 vulnerabilities, 0 critical, 0 exploited
5. [TOTOLINK](https://junglewise.ai/threats/vendors/totolink): 33 vulnerabilities, 33 critical, 0 exploited
6. [Packagist:Https://Packages.drupal.org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8): 103 vulnerabilities, 0 critical, 0 exploited
7. [Drupal](https://junglewise.ai/threats/vendors/drupal): 96 vulnerabilities, 0 critical, 0 exploited
8. [Cisco](https://junglewise.ai/threats/vendors/cisco): 34 vulnerabilities, 5 critical, 0 exploited
9. [IBM](https://junglewise.ai/threats/vendors/ibm): 43 vulnerabilities, 2 critical, 0 exploited
10. [Python Pillow](https://junglewise.ai/threats/vendors/python-pillow): 26 vulnerabilities, 2 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-114625: Arista VeloCloud Orchestrator privilege escalation](https://junglewise.ai/threats/cve-2026-114625-velocloud-orchestrator-vco-on-prem-has-a-security-issue-where) (critical, exploited in the wild, CVSS 9.9, published 22 Oct 2026)
- [CVE-2026-109619: PHP use-after-free in global state handling](https://junglewise.ai/threats/cve-2026-109619-php-has-various-global-state-that-temporarily-points-into) (critical, exploited in the wild, published 21 Oct 2026)
- [CVE-2026-109618: PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070) (critical, exploited in the wild, published 21 Oct 2026)
- [CVE-2026-111057: Mercury Python framework regex bypass in terminal API access](https://junglewise.ai/threats/cve-2026-111057-mercury-is-a-python-framework-for-sharing-jupyter-notebooks-as) (critical, CVSS 10, published 19 Oct 2026)
- [CVE-2026-97785: Microsoft Azure AD App Proxy authentication bypass](https://junglewise.ai/threats/cve-2026-97785-improper-authentication-in-aad-app-proxy-allows-an-unauthorized) (critical, CVSS 10, published 22 Oct 2026)
- [CVE-2026-83938: Azure Kubernetes Configuration Service missing authentication for privilege escalation](https://junglewise.ai/threats/cve-2026-83938-missing-authentication-for-critical-function-in-azure-kubernetes) (critical, CVSS 10, published 22 Oct 2026)
- [CVE-2026-110063: Microsoft VM Inspector for Azure Virtual Machines symlink following privilege escalation](https://junglewise.ai/threats/cve-2026-110063-improper-link-resolution-before-file-access-link-following-in-vm) (critical, CVSS 10, published 22 Oct 2026)
- [CVE-2026-79851: vulnerability](https://junglewise.ai/threats/cve-2026-79851-no-description-provided) (critical, CVSS 10, published 22 Oct 2026)
- [CVE-2026-79850: <UNKNOWN>](https://junglewise.ai/threats/cve-2026-79850-no-description-provided) (critical, CVSS 10, published 22 Oct 2026)
- [CVE-2026-79849: <UNKNOWN>](https://junglewise.ai/threats/cve-2026-79849-no-description-provided) (critical, CVSS 10, published 22 Oct 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 19 to 25 October 2026 (week 43)", https://junglewise.ai/threats/weekly/2026-10-19, 27 October 2026.