# Most vulnerable technologies: week of 26 October to 1 November 2026 (week 44)

Source: https://junglewise.ai/threats/weekly/2026-10-26  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 3 November 2026, 00:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/weekly/2026-10-26.json  
License: CC BY 4.0 with a link back

In the week of 26 October to 1 November 2026, Junglewise Threat Intelligence recorded 3,708 new vulnerabilities: 198 critical, 749 high and 2 exploited in the wild. The most vulnerable technology was Apple macOS Golden Gate, with 246 vulnerabilities (0 critical), followed by Apple macOS (219) and Apple iPadOS (176).

## Ranking

| # | Technology | Vulns | Critical | High | Exploited | Max CVSS |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Apple macOS Golden Gate](https://junglewise.ai/threats/technologies/macos-golden-gate) (Apple) | 246 | 0 | 12 | 0 | 8.8 |
| 2 | [Apple macOS](https://junglewise.ai/threats/technologies/macos) (Apple) | 219 | 0 | 8 | 0 | 8.8 |
| 3 | [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados) (Apple) | 176 | 0 | 9 | 0 | 8.8 |
| 4 | [Apple Ios](https://junglewise.ai/threats/technologies/apple-ios) (Apple) | 175 | 0 | 9 | 0 | 8.8 |
| 5 | [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox) (Mozilla) | 165 | 0 | 0 | 0 | n/a |
| 6 | [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr) (Mozilla) | 145 | 0 | 0 | 0 | n/a |
| 7 | [Apple visionOS](https://junglewise.ai/threats/technologies/visionos) (Apple) | 120 | 0 | 6 | 0 | 8.8 |
| 8 | [Linux Kernel](https://junglewise.ai/threats/technologies/kernel) (Linux) | 127 | 0 | 0 | 0 | n/a |
| 9 | [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss) (IBM) | 32 | 6 | 11 | 0 | 9.9 |
| 10 | [Apple tvOS](https://junglewise.ai/threats/technologies/tvos) (Apple) | 69 | 0 | 3 | 0 | 8.8 |
| 11 | [Dell PowerProtect Data Domain](https://junglewise.ai/threats/technologies/powerprotect-data-domain) (Dell) | 31 | 4 | 12 | 0 | 9.8 |
| 12 | [Google Chrome](https://junglewise.ai/threats/technologies/chrome) (Google) | 74 | 0 | 0 | 0 | 4.6 |
| 13 | [Hitachi JP1/Automatic Job Management System 3 - Manager](https://junglewise.ai/threats/technologies/jp1-automatic-job-management-system-3-manager) (Hitachi) | 11 | 11 | 0 | 0 | 9.8 |
| 14 | [Apple watchOS](https://junglewise.ai/threats/technologies/watchos) (Apple) | 57 | 0 | 3 | 0 | 8.8 |
| 15 | [Progress Software WS FTP Server](https://junglewise.ai/threats/technologies/progress-software-ws-ftp-server) (Progress Software) | 15 | 6 | 3 | 0 | 10 |
| 16 | [Oray Pugongying X5 Pro](https://junglewise.ai/threats/technologies/pugongying-x5-pro) (Oray) | 9 | 7 | 2 | 0 | 9.9 |
| 17 | [Adobe Campaign Classic](https://junglewise.ai/threats/technologies/campaign-classic) (Adobe) | 8 | 8 | 0 | 0 | 10 |
| 18 | [Hitachi JP1/Automatic Job Management System 3 - Agent](https://junglewise.ai/threats/technologies/jp1-automatic-job-management-system-3-agent) (Hitachi) | 8 | 8 | 0 | 0 | 9.8 |
| 19 | [Apple Safari](https://junglewise.ai/threats/technologies/safari) (Apple) | 33 | 0 | 6 | 0 | 8.8 |
| 20 | [N8n](https://junglewise.ai/threats/technologies/n8n) (N8n) | 17 | 0 | 13 | 0 | 8.8 |
| 21 | [Microsoft Edge](https://junglewise.ai/threats/technologies/edge) (Microsoft) | 16 | 0 | 12 | 0 | 8.8 |
| 22 | [Hitachi HiRDB Server Version 10](https://junglewise.ai/threats/technologies/hirdb-server-version-10) (Hitachi) | 7 | 6 | 1 | 0 | 9.8 |
| 23 | [Hitachi HiRDB Server Version 9](https://junglewise.ai/threats/technologies/hirdb-server-version-9) (Hitachi) | 7 | 6 | 1 | 0 | 9.8 |
| 24 | [Hitachi HiRDB Server Version 9(32)](https://junglewise.ai/threats/technologies/hirdb-server-version-9-32) (Hitachi) | 7 | 6 | 1 | 0 | 9.8 |
| 25 | [Hitachi HiRDB Server with Additional Function Version 9](https://junglewise.ai/threats/technologies/hirdb-server-with-additional-function-version-9) (Hitachi) | 7 | 6 | 1 | 0 | 9.8 |

## Most affected vendors

1. [Apple](https://junglewise.ai/threats/vendors/apple): 322 vulnerabilities, 0 critical, 0 exploited
2. [Mozilla](https://junglewise.ai/threats/vendors/mozilla): 176 vulnerabilities, 0 critical, 0 exploited
3. [Dell](https://junglewise.ai/threats/vendors/dell): 58 vulnerabilities, 7 critical, 0 exploited
4. [Linux](https://junglewise.ai/threats/vendors/linux): 119 vulnerabilities, 0 critical, 0 exploited
5. [Hitachi](https://junglewise.ai/threats/vendors/hitachi): 19 vulnerabilities, 18 critical, 0 exploited
6. [Drupal](https://junglewise.ai/threats/vendors/drupal): 106 vulnerabilities, 0 critical, 0 exploited
7. [Packagist:Https://Packages.drupal.org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8): 97 vulnerabilities, 0 critical, 0 exploited
8. [Google](https://junglewise.ai/threats/vendors/google): 83 vulnerabilities, 0 critical, 0 exploited
9. [IBM](https://junglewise.ai/threats/vendors/ibm): 32 vulnerabilities, 6 critical, 0 exploited
10. [Wavlink](https://junglewise.ai/threats/vendors/wavlink): 12 vulnerabilities, 12 critical, 0 exploited

## Most severe vulnerabilities

- [CVE-2026-76418: Cisco Secure Firewall ASA and FTD SSL VPN denial of service](https://junglewise.ai/threats/cve-2026-76418-a-vulnerability-in-the-remote-access-ssl-vpn-service-of-cisco) (critical, exploited in the wild, CVSS 8.6, published 28 Oct 2026)
- [CVE-2026-118527: Ivanti Connect Secure predictable identifier generation](https://junglewise.ai/threats/cve-2026-118527-ivanti-connect-secure-generation-of-predictable-numbers-or) (critical, exploited in the wild, published 30 Oct 2026)
- [CVE-2026-120198: WAVLINK WL-WN530BE1-A command injection in protocol.csp](https://junglewise.ai/threats/cve-2026-120198-a-vulnerability-has-been-found-in-wavlink-wl-wn530be1-a-v251117) (critical, CVSS 10, published 1 Nov 2026)
- [CVE-2026-120338: Prefab UI sandbox escape via unrestricted Deno permissions](https://junglewise.ai/threats/cve-2026-120338-prefab-ui-s-generative-ui-sandbox-runs-caller-supplied-python) (critical, CVSS 10, published 1 Nov 2026)
- [CVE-2026-120195: WAVLINK WL-WN579A3-A command injection in Initial Setup Wizard](https://junglewise.ai/threats/cve-2026-120195-a-security-vulnerability-has-been-detected-in-wavlink-wl-wn579a3) (critical, CVSS 10, published 1 Nov 2026)
- [CVE-2026-120189: D-Link DIR-505 stack-based buffer overflow in TFTP upload handler](https://junglewise.ai/threats/cve-2026-120189-a-vulnerability-was-identified-in-d-link-dir-505-1-10b02) (critical, CVSS 10, published 1 Nov 2026)
- [CVE-2026-61826: Bazarr Plex OAuth authentication bypass](https://junglewise.ai/threats/cve-2026-61826-bazarr-is-a-companion-application-to-sonarr-and-radarr-prior-to-1) (critical, CVSS 10, published 30 Oct 2026)
- [CVE-2026-61738: SOCFortress CoPilot path traversal in ScoutSuite report upload](https://junglewise.ai/threats/cve-2026-61738-socfortress-copilot-focuses-on-providing-a-single-pane-of-glass) (critical, CVSS 10, published 30 Oct 2026)
- [CVE-2026-84295: Progress Software WS_FTP Server authentication bypass](https://junglewise.ai/threats/cve-2026-84295-improper-authentication-in-progress-software-ws-ftp-server) (critical, CVSS 10, published 29 Oct 2026)
- [CVE-2026-61991: Ajax Load More Cache remote code execution](https://junglewise.ai/threats/cve-2026-61991-unauthenticated-remote-code-execution-rce-in-ajaxloadmore-cache-3) (critical, CVSS 10, published 29 Oct 2026)

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Most vulnerable technologies: week of 26 October to 1 November 2026 (week 44)", https://junglewise.ai/threats/weekly/2026-10-26, 3 November 2026.