{"schema_version":1,"title":"Most vulnerable technologies: week of 2 to 8 November 2026 (week 45)","summary":"In the week of 2 to 8 November 2026, Junglewise Threat Intelligence recorded 3,636 new vulnerabilities: 218 critical, 826 high and 7 exploited in the wild. The most vulnerable technology was IBM API Connect, with 205 vulnerabilities (47 critical), followed by Google Chrome (215) and OpenEMR (56).","url":"https://junglewise.ai/threats/weekly/2026-11-02","json_url":"https://junglewise.ai/threats/weekly/2026-11-02.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/weekly/2026-11-02","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","method":"Technologies are ranked by 10 points per vulnerability exploited in the wild, 5 per critical, 2 per high and 1 per vulnerability, over vulnerabilities published in the period (UTC). A vulnerability counts for every technology it affects.","kind":"week","period":{"end":"2026-11-08","start":"2026-11-02"},"totals":{"high":826,"tracked":4824,"critical":218,"exploited":7,"technologies":1784,"vulnerabilities":3636},"notable":[{"cve":"CVE-2026-116779","cvss":9.8,"epss":0.013,"slug":"cve-2026-116779-freeswitch-is-a-software-defined-telecom-stack-enabling-the","title":"FreeSWITCH command injection via SIP MESSAGE chat protocol","severity":"critical","exploited":true,"published_at":"2026-11-05T20:17:44.79+00:00","url":"https://junglewise.ai/threats/cve-2026-116779-freeswitch-is-a-software-defined-telecom-stack-enabling-the"},{"cve":"CVE-2026-123218","cvss":9.8,"epss":0.004,"slug":"cve-2026-123218-ibm-aspera-faspex-5-0-0-through-5-0-19-could-allow-an-authorized","title":"IBM Aspera Faspex authorization bypass","severity":"critical","exploited":true,"published_at":"2026-11-07T04:17:28.9+00:00","url":"https://junglewise.ai/threats/cve-2026-123218-ibm-aspera-faspex-5-0-0-through-5-0-19-could-allow-an-authorized"},{"cve":"CVE-2026-102895","cvss":9.8,"epss":0.0033,"slug":"cve-2026-102895-gpustack-is-an-open-source-gpu-cluster-manager-for-ai-model","title":"GPUStack authentication bypass via localhost spoofing","severity":"critical","exploited":true,"published_at":"2026-11-04T22:17:44.613+00:00","url":"https://junglewise.ai/threats/cve-2026-102895-gpustack-is-an-open-source-gpu-cluster-manager-for-ai-model"},{"cve":"CVE-2026-123158","cvss":8.1,"epss":0.0101,"slug":"cve-2026-123158-sshd-in-openssh-before-10-6p2-on-linux-when-musl-libc-is-used","title":"OpenSSH password authentication bypass on musl libc without PAM","severity":"critical","exploited":true,"published_at":"2026-11-05T16:17:47.11+00:00","url":"https://junglewise.ai/threats/cve-2026-123158-sshd-in-openssh-before-10-6p2-on-linux-when-musl-libc-is-used"},{"cve":"CVE-2026-118527","cvss":4.3,"slug":"cve-2026-118527-ivanti-connect-secure-generation-of-predictable-numbers-or","title":"Ivanti Connect Secure predictable identifier generation","severity":"critical","exploited":true,"published_at":"2026-11-03T15:17:24.92+00:00","url":"https://junglewise.ai/threats/cve-2026-118527-ivanti-connect-secure-generation-of-predictable-numbers-or"},{"cve":"CVE-2024-27834","epss":0.006,"slug":"cve-2024-27834-apple-multiple-products-improper-authentication-vulnerability","title":"Apple iOS, iPadOS, macOS, Safari, tvOS, watchOS pointer authentication bypass","severity":"critical","exploited":true,"published_at":"2026-11-04T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-27834-apple-multiple-products-improper-authentication-vulnerability"},{"cve":"CVE-2026-19868","slug":"cve-2026-19868-an-authentication-enforcement-vulnerability-in-sonicos-sslvpn","title":"SonicWall SonicOS SSLVPN SAML authentication bypass","severity":"critical","exploited":true,"published_at":"2026-11-06T19:17:48.437+00:00","url":"https://junglewise.ai/threats/cve-2026-19868-an-authentication-enforcement-vulnerability-in-sonicos-sslvpn"},{"cve":"CVE-2026-123551","cvss":10,"slug":"cve-2026-123551-openam-from-14-0-0-before-16-1-4-contains-an-information","title":"OpenAM unauthenticated session token disclosure via WebSocket","severity":"critical","exploited":false,"published_at":"2026-11-08T02:16:46.603+00:00","url":"https://junglewise.ai/threats/cve-2026-123551-openam-from-14-0-0-before-16-1-4-contains-an-information"},{"cve":"CVE-2026-123966","cvss":10,"slug":"cve-2026-123966-a-vulnerability-was-determined-in-tenda-ac19-16-03-10-07","title":"Tenda AC19 heap buffer overflow in saveParentControlInfo","severity":"critical","exploited":false,"published_at":"2026-11-07T14:17:01.8+00:00","url":"https://junglewise.ai/threats/cve-2026-123966-a-vulnerability-was-determined-in-tenda-ac19-16-03-10-07"},{"cve":"CVE-2026-109469","cvss":10,"slug":"cve-2026-109469-authorization-bypass-through-user-controlled-key-in-entra-device","title":"Microsoft Entra Device Registration authorization bypass in key validation","severity":"critical","exploited":false,"published_at":"2026-11-06T23:17:20.557+00:00","url":"https://junglewise.ai/threats/cve-2026-109469-authorization-bypass-through-user-controlled-key-in-entra-device"}],"vendors":[{"hub":true,"high":118,"name":"IBM","rank":1,"slug":"ibm","critical":55,"exploited":1,"vulnerabilities":309,"url":"https://junglewise.ai/threats/vendors/ibm"},{"hub":true,"high":4,"name":"Google","rank":2,"slug":"google","critical":2,"exploited":0,"vulnerabilities":352,"url":"https://junglewise.ai/threats/vendors/google"},{"hub":true,"high":31,"name":"Jetbrains","rank":3,"slug":"jetbrains","critical":4,"exploited":0,"vulnerabilities":72,"url":"https://junglewise.ai/threats/vendors/jetbrains"},{"hub":true,"high":28,"name":"OpenEMR","rank":4,"slug":"openemr","critical":5,"exploited":0,"vulnerabilities":56,"url":"https://junglewise.ai/threats/vendors/openemr"},{"hub":true,"high":27,"name":"Hpe","rank":5,"slug":"hpe","critical":3,"exploited":0,"vulnerabilities":51,"url":"https://junglewise.ai/threats/vendors/hpe"},{"hub":true,"high":0,"name":"Apache","rank":6,"slug":"apache","critical":0,"exploited":0,"vulnerabilities":95,"url":"https://junglewise.ai/threats/vendors/apache"},{"hub":true,"high":10,"name":"Linux","rank":7,"slug":"linux","critical":0,"exploited":0,"vulnerabilities":71,"url":"https://junglewise.ai/threats/vendors/linux"},{"hub":true,"high":13,"name":"Kyverno","rank":8,"slug":"kyverno","critical":8,"exploited":0,"vulnerabilities":22,"url":"https://junglewise.ai/threats/vendors/kyverno"},{"hub":true,"high":21,"name":"SuiteCRM","rank":9,"slug":"suitecrm","critical":1,"exploited":0,"vulnerabilities":31,"url":"https://junglewise.ai/threats/vendors/suitecrm"},{"hub":true,"high":0,"name":"TOTOLINK","rank":10,"slug":"totolink","critical":13,"exploited":0,"vulnerabilities":13,"url":"https://junglewise.ai/threats/vendors/totolink"}],"generated_at":"2026-11-10T00:07:00.200165+00:00","technologies":[{"hub":true,"top":[{"cve":"CVE-2026-17410","cvss":9.9,"slug":"cve-2026-17410-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through","title":"IBM API Connect argument delimiter neutralization in multi-tenant","severity":"critical","exploited":false,"published_at":"2026-11-07T05:18:58.41+00:00","url":"https://junglewise.ai/threats/cve-2026-17410-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through"},{"cve":"CVE-2026-17402","cvss":9.9,"slug":"cve-2026-17402-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through","title":"IBM API Connect OS command injection","severity":"critical","exploited":false,"published_at":"2026-11-07T05:18:56.46+00:00","url":"https://junglewise.ai/threats/cve-2026-17402-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through"},{"cve":"CVE-2026-17399","cvss":9.9,"slug":"cve-2026-17399-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through","title":"IBM API Connect arbitrary code execution via insufficient upload validation","severity":"critical","exploited":false,"published_at":"2026-11-07T05:18:55.79+00:00","url":"https://junglewise.ai/threats/cve-2026-17399-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through"}],"high":94,"name":"IBM API Connect","rank":1,"slug":"api-connect","score":628,"vendor":{"hub":true,"name":"IBM","slug":"ibm"},"critical":47,"max_cvss":9.9,"max_epss":null,"exploited":0,"vulnerabilities":205,"url":"https://junglewise.ai/threats/technologies/api-connect"},{"hub":true,"top":[{"cve":"CVE-2026-120931","cvss":9.6,"slug":"cve-2026-120931-out-of-bounds-write-in-webgl-in-google-chrome-on-on-android","title":"Google Chrome out-of-bounds write in WebGL on Android","severity":"critical","exploited":false,"published_at":"2026-11-03T22:19:31.9+00:00","url":"https://junglewise.ai/threats/cve-2026-120931-out-of-bounds-write-in-webgl-in-google-chrome-on-on-android"},{"cve":"CVE-2026-121182","cvss":8.8,"slug":"cve-2026-121182-use-after-free-in-dom-in-google-chrome-prior-to-157-0-8103-38","title":"Google Chrome use after free in DOM","severity":"high","exploited":false,"published_at":"2026-11-03T21:17:26.787+00:00","url":"https://junglewise.ai/threats/cve-2026-121182-use-after-free-in-dom-in-google-chrome-prior-to-157-0-8103-38"},{"cve":"CVE-2026-120930","slug":"cve-2026-120930-incorrect-authorization-in-blink-in-google-chrome-prior-to-156-0","title":"Google Chrome incorrect authorization in Blink web origin bypass","severity":"info","exploited":false,"published_at":"2026-11-03T22:19:31.76+00:00","url":"https://junglewise.ai/threats/cve-2026-120930-incorrect-authorization-in-blink-in-google-chrome-prior-to-156-0"}],"high":1,"name":"Google Chrome","rank":2,"slug":"chrome","score":222,"vendor":{"hub":true,"name":"Google","slug":"google"},"critical":1,"max_cvss":9.6,"max_epss":null,"exploited":0,"vulnerabilities":215,"url":"https://junglewise.ai/threats/technologies/chrome"},{"hub":true,"top":[{"cve":"CVE-2026-124469","cvss":9.9,"slug":"cve-2026-124469-openemr-before-8-3-0-contains-an-sql-injection-vulnerability-in","title":"OpenEMR SQL injection in Fee Sheet drug-inventory lookup","severity":"critical","exploited":false,"published_at":"2026-11-08T14:18:15.13+00:00","url":"https://junglewise.ai/threats/cve-2026-124469-openemr-before-8-3-0-contains-an-sql-injection-vulnerability-in"},{"cve":"CVE-2026-124450","cvss":9.9,"slug":"cve-2026-124450-openemr-before-8-3-0-contains-a-broken-access-control-and-path","title":"OpenEMR fax/sms module broken access control and path traversal","severity":"critical","exploited":false,"published_at":"2026-11-08T14:18:12.26+00:00","url":"https://junglewise.ai/threats/cve-2026-124450-openemr-before-8-3-0-contains-a-broken-access-control-and-path"},{"cve":"CVE-2026-124445","cvss":9.8,"slug":"cve-2026-124445-openemr-from-7-0-1-before-8-4-0-contains-a-flaw-in-src-common","title":"OpenEMR OneTimeAuth token replay and PIN brute force","severity":"critical","exploited":false,"published_at":"2026-11-08T14:18:11.487+00:00","url":"https://junglewise.ai/threats/cve-2026-124445-openemr-from-7-0-1-before-8-4-0-contains-a-flaw-in-src-common"}],"high":28,"name":"OpenEMR","rank":3,"slug":"openemr-openemr","score":137,"vendor":{"hub":true,"name":"OpenEMR","slug":"openemr"},"critical":5,"max_cvss":9.9,"max_epss":null,"exploited":0,"vulnerabilities":56,"url":"https://junglewise.ai/threats/technologies/openemr-openemr"},{"hub":true,"top":[{"cve":"CVE-2026-28588","cvss":8.4,"slug":"cve-2026-28588-in-shouldblockdirectoryfromtree-of-externalstorageprovider-java","title":"Android Framework privilege escalation in ExternalStorageProvider","severity":"high","exploited":false,"published_at":"2026-11-02T20:17:41.713+00:00","url":"https://junglewise.ai/threats/cve-2026-28588-in-shouldblockdirectoryfromtree-of-externalstorageprovider-java"},{"cve":"CVE-2026-58930","slug":"cve-2026-58930-an-unprivileged-application-can-exploit-a-lack-of-package","title":"Android SystemUI signature validation bypass in RemoteQCController","severity":"info","exploited":false,"published_at":"2026-11-02T21:17:36.38+00:00","url":"https://junglewise.ai/threats/cve-2026-58930-an-unprivileged-application-can-exploit-a-lack-of-package"},{"cve":"CVE-2026-58927","slug":"cve-2026-58927-the-vulnerability-is-a-use-after-free-uaf-in-the-evs-aidl-hal","title":"Android EVS AIDL HAL use-after-free in openCamera","severity":"info","exploited":false,"published_at":"2026-11-02T21:17:36.26+00:00","url":"https://junglewise.ai/threats/cve-2026-58927-the-vulnerability-is-a-use-after-free-uaf-in-the-evs-aidl-hal"}],"high":1,"name":"Google Android","rank":4,"slug":"android","score":119,"vendor":{"hub":true,"name":"Google","slug":"google"},"critical":0,"max_cvss":8.4,"max_epss":null,"exploited":0,"vulnerabilities":117,"url":"https://junglewise.ai/threats/technologies/android"},{"hub":true,"top":[{"cve":"CVE-2026-95731","cvss":9.8,"slug":"cve-2026-95731-hardcoded-password-vulnerabilities-in-the-command-line-interface","title":"HPE Networking Fabric Composer hardcoded password in CLI","severity":"critical","exploited":false,"published_at":"2026-11-03T20:18:21.197+00:00","url":"https://junglewise.ai/threats/cve-2026-95731-hardcoded-password-vulnerabilities-in-the-command-line-interface"},{"cve":"CVE-2026-95733","cvss":9.6,"slug":"cve-2026-95733-a-vulnerability-exists-in-a-component-of-hpe-networking-fabric","title":"HPE Networking Fabric Composer arbitrary code execution","severity":"critical","exploited":false,"published_at":"2026-11-03T20:18:21.433+00:00","url":"https://junglewise.ai/threats/cve-2026-95733-a-vulnerability-exists-in-a-component-of-hpe-networking-fabric"},{"cve":"CVE-2026-95732","cvss":9.6,"slug":"cve-2026-95732-an-authentication-bypass-vulnerability-exists-in-the-underlying","title":"HPE Networking Fabric Composer authentication bypass in OS","severity":"critical","exploited":false,"published_at":"2026-11-03T20:18:21.32+00:00","url":"https://junglewise.ai/threats/cve-2026-95732-an-authentication-bypass-vulnerability-exists-in-the-underlying"}],"high":20,"name":"Hpe Networking Fabric Composer","rank":5,"slug":"networking-fabric-composer","score":96,"vendor":{"hub":true,"name":"Hpe","slug":"hpe"},"critical":3,"max_cvss":9.8,"max_epss":null,"exploited":0,"vulnerabilities":41,"url":"https://junglewise.ai/threats/technologies/networking-fabric-composer"},{"hub":true,"top":[{"cve":"CVE-2026-99239","cvss":7.8,"slug":"cve-2026-99239-in-the-linux-kernel-the-following-vulnerability-has-been-resolved","title":"Linux kernel Bluetooth L2CAP race condition in channel connection","severity":"high","exploited":false,"published_at":"2026-11-02T16:17:49.54+00:00","url":"https://junglewise.ai/threats/cve-2026-99239-in-the-linux-kernel-the-following-vulnerability-has-been-resolved"},{"cve":"CVE-2026-99238","cvss":7.8,"slug":"cve-2026-99238-in-the-linux-kernel-the-following-vulnerability-has-been-resolved","title":"Linux kernel race condition in tracing module updates","severity":"high","exploited":false,"published_at":"2026-11-02T16:17:49.38+00:00","url":"https://junglewise.ai/threats/cve-2026-99238-in-the-linux-kernel-the-following-vulnerability-has-been-resolved"},{"cve":"CVE-2026-99237","cvss":7.8,"slug":"cve-2026-99237-in-the-linux-kernel-the-following-vulnerability-has-been-resolved","title":"Linux kernel tracing use-after-free in last boot data reset","severity":"high","exploited":false,"published_at":"2026-11-02T16:17:49.213+00:00","url":"https://junglewise.ai/threats/cve-2026-99237-in-the-linux-kernel-the-following-vulnerability-has-been-resolved"}],"high":10,"name":"Linux Kernel","rank":6,"slug":"kernel","score":95,"vendor":{"hub":true,"name":"Linux","slug":"linux"},"critical":0,"max_cvss":7.8,"max_epss":null,"exploited":0,"vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/kernel"},{"hub":true,"top":[{"cve":"CVE-2026-124440","cvss":9.9,"slug":"cve-2026-124440-kyverno-from-1-19-1-before-1-19-2-contains-an-authorization","title":"Kyverno apiCall authorization bypass in namespace clamp","severity":"critical","exploited":false,"published_at":"2026-11-08T14:18:10.633+00:00","url":"https://junglewise.ai/threats/cve-2026-124440-kyverno-from-1-19-1-before-1-19-2-contains-an-authorization"},{"cve":"CVE-2026-122313","cvss":9.9,"slug":"cve-2026-122313-kyverno-from-1-17-0-before-1-19-2-contains-a-privilege","title":"Kyverno NamespacedMutatingPolicy privilege escalation via CEL expression","severity":"critical","exploited":false,"published_at":"2026-11-05T03:17:23.853+00:00","url":"https://junglewise.ai/threats/cve-2026-122313-kyverno-from-1-17-0-before-1-19-2-contains-a-privilege"},{"cve":"CVE-2026-122311","cvss":9.9,"slug":"cve-2026-122311-kyverno-from-1-16-0-before-1-19-2-fails-to-validate-path","title":"Kyverno path traversal in namespaced CEL policies via resource argument","severity":"critical","exploited":false,"published_at":"2026-11-05T03:17:23.497+00:00","url":"https://junglewise.ai/threats/cve-2026-122311-kyverno-from-1-16-0-before-1-19-2-fails-to-validate-path"}],"high":13,"name":"Kyverno","rank":7,"slug":"kyverno","score":88,"vendor":{"hub":true,"name":"Kyverno","slug":"kyverno"},"critical":8,"max_cvss":9.9,"max_epss":null,"exploited":0,"vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/kyverno"},{"hub":true,"top":[{"cve":"CVE-2026-71550","cvss":9.9,"slug":"cve-2026-71550-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM path traversal in workflow controller","severity":"critical","exploited":false,"published_at":"2026-11-05T19:17:26.357+00:00","url":"https://junglewise.ai/threats/cve-2026-71550-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-97377","cvss":8.8,"slug":"cve-2026-97377-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in SOAP portal API","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:29.28+00:00","url":"https://junglewise.ai/threats/cve-2026-97377-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-71548","cvss":8.8,"slug":"cve-2026-71548-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in report query builder","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:26.183+00:00","url":"https://junglewise.ai/threats/cve-2026-71548-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"}],"high":21,"name":"SuiteCRM","rank":8,"slug":"suitecrm-suitecrm","score":78,"vendor":{"hub":true,"name":"SuiteCRM","slug":"suitecrm"},"critical":1,"max_cvss":9.9,"max_epss":null,"exploited":0,"vulnerabilities":31,"url":"https://junglewise.ai/threats/technologies/suitecrm-suitecrm"},{"hub":true,"top":[{"cve":"CVE-2026-116779","cvss":9.8,"epss":0.013,"slug":"cve-2026-116779-freeswitch-is-a-software-defined-telecom-stack-enabling-the","title":"FreeSWITCH command injection via SIP MESSAGE chat protocol","severity":"critical","exploited":true,"published_at":"2026-11-05T20:17:44.79+00:00","url":"https://junglewise.ai/threats/cve-2026-116779-freeswitch-is-a-software-defined-telecom-stack-enabling-the"},{"cve":"CVE-2026-116790","cvss":9.1,"slug":"cve-2026-116790-freeswitch-is-a-software-defined-telecom-stack-enabling-the","title":"FreeSWITCH ICE integrity validation bypass","severity":"critical","exploited":false,"published_at":"2026-11-05T20:17:46.557+00:00","url":"https://junglewise.ai/threats/cve-2026-116790-freeswitch-is-a-software-defined-telecom-stack-enabling-the"},{"cve":"CVE-2026-116785","cvss":9.1,"slug":"cve-2026-116785-freeswitch-is-a-software-defined-telecom-stack-enabling-the","title":"FreeSWITCH WebSocket frame length heap overflow","severity":"critical","exploited":false,"published_at":"2026-11-05T20:17:45.73+00:00","url":"https://junglewise.ai/threats/cve-2026-116785-freeswitch-is-a-software-defined-telecom-stack-enabling-the"}],"high":11,"name":"SignalWire Freeswitch","rank":9,"slug":"freeswitch","score":66,"vendor":{"hub":true,"name":"SignalWire","slug":"signalwire"},"critical":3,"max_cvss":9.8,"max_epss":0.013,"exploited":1,"vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/freeswitch"},{"hub":true,"top":[{"cve":"CVE-2026-121953","cvss":9.8,"slug":"cve-2026-121953-freerdp-before-3-32-2-has-a-use-after-free-in-the-client-s","title":"FreeRDP use-after-free in rdpgfx dynamic virtual channel","severity":"critical","exploited":false,"published_at":"2026-11-04T16:17:47.717+00:00","url":"https://junglewise.ai/threats/cve-2026-121953-freerdp-before-3-32-2-has-a-use-after-free-in-the-client-s"},{"cve":"CVE-2026-121952","cvss":9.8,"slug":"cve-2026-121952-freerdp-before-3-32-2-has-an-out-of-bounds-write-in-the-proxy","title":"FreeRDP out-of-bounds write in bitmap cache v2 capability","severity":"critical","exploited":false,"published_at":"2026-11-04T16:17:47.53+00:00","url":"https://junglewise.ai/threats/cve-2026-121952-freerdp-before-3-32-2-has-an-out-of-bounds-write-in-the-proxy"},{"cve":"CVE-2026-121958","cvss":8.8,"slug":"cve-2026-121958-freerdp-through-3-32-1-has-a-heap-out-of-bounds-write-in-the","title":"FreeRDP heap out-of-bounds write in RDPGFX HashTable_GetKeys","severity":"high","exploited":false,"published_at":"2026-11-04T16:17:48.61+00:00","url":"https://junglewise.ai/threats/cve-2026-121958-freerdp-through-3-32-1-has-a-heap-out-of-bounds-write-in-the"}],"high":8,"name":"FreeRDP","rank":10,"slug":"freerdp","score":57,"vendor":{"hub":true,"name":"FreeRDP","slug":"freerdp"},"critical":2,"max_cvss":9.8,"max_epss":null,"exploited":0,"vulnerabilities":31,"url":"https://junglewise.ai/threats/technologies/freerdp"},{"hub":true,"top":[{"cve":"CVE-2026-92190","cvss":9.8,"slug":"cve-2026-92190-quest-foglight-for-databases-basermiserviceexporter","title":"Quest Foglight for Databases deserialization of untrusted data RCE","severity":"critical","exploited":false,"published_at":"2026-11-04T00:17:29.39+00:00","url":"https://junglewise.ai/threats/cve-2026-92190-quest-foglight-for-databases-basermiserviceexporter"},{"cve":"CVE-2026-92189","cvss":9.8,"slug":"cve-2026-92189-quest-foglight-for-databases-writetopologysectiontofile-external","title":"Quest Foglight for Databases arbitrary file path code execution","severity":"critical","exploited":false,"published_at":"2026-11-04T00:17:29.26+00:00","url":"https://junglewise.ai/threats/cve-2026-92189-quest-foglight-for-databases-writetopologysectiontofile-external"},{"cve":"CVE-2026-92188","cvss":9.8,"slug":"cve-2026-92188-quest-foglight-for-databases-forgembeanserversupport-missing","title":"Quest Foglight for Databases authentication bypass in ForgeMBeanServerSupport","severity":"critical","exploited":false,"published_at":"2026-11-04T00:17:29.13+00:00","url":"https://junglewise.ai/threats/cve-2026-92188-quest-foglight-for-databases-forgembeanserversupport-missing"}],"high":12,"name":"Quest Foglight for Databases","rank":11,"slug":"foglight-for-databases","score":55,"vendor":{"hub":true,"name":"Quest","slug":"quest"},"critical":3,"max_cvss":9.8,"max_epss":null,"exploited":0,"vulnerabilities":16,"url":"https://junglewise.ai/threats/technologies/foglight-for-databases"},{"hub":true,"top":[{"cve":"CVE-2026-123961","cvss":9.9,"slug":"cve-2026-123961-a-security-vulnerability-has-been-detected-in-totolink-ca300-poe","title":"TOTOLINK CA300-PoE buffer overflow in setWiFiBasicConfig","severity":"critical","exploited":false,"published_at":"2026-11-07T11:17:01.29+00:00","url":"https://junglewise.ai/threats/cve-2026-123961-a-security-vulnerability-has-been-detected-in-totolink-ca300-poe"},{"cve":"CVE-2026-123960","cvss":9.9,"slug":"cve-2026-123960-a-weakness-has-been-identified-in-totolink-ca300-poe-6-2c-884","title":"TOTOLINK CA300-PoE buffer overflow in setWanConfig","severity":"critical","exploited":false,"published_at":"2026-11-07T10:17:12.357+00:00","url":"https://junglewise.ai/threats/cve-2026-123960-a-weakness-has-been-identified-in-totolink-ca300-poe-6-2c-884"},{"cve":"CVE-2026-123958","cvss":9.9,"slug":"cve-2026-123958-a-vulnerability-was-identified-in-totolink-ca300-poe-6-2c-884","title":"TOTOLINK CA300-PoE buffer overflow in setLanConfig","severity":"critical","exploited":false,"published_at":"2026-11-07T09:17:15.177+00:00","url":"https://junglewise.ai/threats/cve-2026-123958-a-vulnerability-was-identified-in-totolink-ca300-poe-6-2c-884"}],"high":0,"name":"TOTOLINK CA300-PoE","rank":12,"slug":"ca300-poe","score":54,"vendor":{"hub":true,"name":"TOTOLINK","slug":"totolink"},"critical":9,"max_cvss":9.9,"max_epss":null,"exploited":0,"vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/ca300-poe"},{"hub":true,"top":[{"cve":"CVE-2026-120984","cvss":9.1,"slug":"cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management","title":"Keycloak server arbitrary code execution in client authorization","severity":"critical","exploited":false,"published_at":"2026-11-07T14:17:01.58+00:00","url":"https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management"},{"cve":"CVE-2026-117691","cvss":9.1,"slug":"cve-2026-117691-a-flaw-was-found-in-the-saml-http-redirect-binding","title":"Keycloak SAML signature bypass via percent-encoded parameters","severity":"critical","exploited":false,"published_at":"2026-11-05T14:17:01.32+00:00","url":"https://junglewise.ai/threats/cve-2026-117691-a-flaw-was-found-in-the-saml-http-redirect-binding"},{"cve":"CVE-2026-97175","cvss":8.8,"slug":"cve-2026-97175-a-flaw-was-found-in-the-idp-auto-link-authenticator-of-the","title":"Keycloak idp-auto-link authenticator account takeover","severity":"high","exploited":false,"published_at":"2026-11-05T18:17:11.67+00:00","url":"https://junglewise.ai/threats/cve-2026-97175-a-flaw-was-found-in-the-idp-auto-link-authenticator-of-the"}],"high":11,"name":"Red Hat Keycloak","rank":13,"slug":"red-hat-keycloak","score":52,"vendor":{"hub":true,"name":"Red Hat","slug":"red-hat"},"critical":2,"max_cvss":9.1,"max_epss":null,"exploited":0,"vulnerabilities":20,"url":"https://junglewise.ai/threats/technologies/red-hat-keycloak"},{"hub":true,"top":[{"cve":"CVE-2026-123301","cvss":8.2,"slug":"cve-2026-123301-in-jetbrains-intellij-idea-before-2026-3-dom-based-xss-in-the","title":"JetBrains IntelliJ IDEA DOM-based XSS in OpenAPI preview error view","severity":"high","exploited":false,"published_at":"2026-11-06T11:17:09.067+00:00","url":"https://junglewise.ai/threats/cve-2026-123301-in-jetbrains-intellij-idea-before-2026-3-dom-based-xss-in-the"},{"cve":"CVE-2026-123853","cvss":7.8,"slug":"cve-2026-123853-in-jetbrains-intellij-idea-before-2026-3-2026-2-2-code-execution","title":"JetBrains IntelliJ IDEA code execution via JVM options in Safe Mode","severity":"high","exploited":false,"published_at":"2026-11-06T17:17:24.43+00:00","url":"https://junglewise.ai/threats/cve-2026-123853-in-jetbrains-intellij-idea-before-2026-3-2026-2-2-code-execution"},{"cve":"CVE-2026-123841","cvss":7.8,"slug":"cve-2026-123841-in-jetbrains-intellij-idea-before-2026-3-code-execution-was","title":"JetBrains IntelliJ IDEA code execution via symlinks in settings archive","severity":"high","exploited":false,"published_at":"2026-11-06T17:17:22.693+00:00","url":"https://junglewise.ai/threats/cve-2026-123841-in-jetbrains-intellij-idea-before-2026-3-code-execution-was"}],"high":13,"name":"Jetbrains IntelliJ IDEA","rank":14,"slug":"intellij-idea","score":50,"vendor":{"hub":true,"name":"Jetbrains","slug":"jetbrains"},"critical":0,"max_cvss":8.2,"max_epss":null,"exploited":0,"vulnerabilities":24,"url":"https://junglewise.ai/threats/technologies/intellij-idea"},{"hub":true,"top":[{"cve":"CVE-2026-122193","cvss":9.9,"slug":"cve-2026-122193-os-command-injection-in-the-example-ssm-document-provisioning","title":"AWS Trusted Remote Execution OS command injection in SSM document","severity":"critical","exploited":false,"published_at":"2026-11-06T17:17:20.313+00:00","url":"https://junglewise.ai/threats/cve-2026-122193-os-command-injection-in-the-example-ssm-document-provisioning"},{"cve":"CVE-2026-119923","cvss":9.8,"slug":"cve-2026-119923-a-heap-based-buffer-overflow-in-the-tds-prelogin-parser-in-the","title":"Babelfish for PostgreSQL heap-based buffer overflow in TDS prelogin parser","severity":"critical","exploited":false,"published_at":"2026-11-06T19:17:39.36+00:00","url":"https://junglewise.ai/threats/cve-2026-119923-a-heap-based-buffer-overflow-in-the-tds-prelogin-parser-in-the"},{"cve":"CVE-2026-119922","cvss":8.8,"slug":"cve-2026-119922-babelfish-for-postgresql-privilege-escalation","title":"Babelfish for PostgreSQL privilege escalation","severity":"high","exploited":false,"published_at":"2026-11-03T19:17:57.02+00:00","url":"https://junglewise.ai/threats/cve-2026-119922-babelfish-for-postgresql-privilege-escalation"}],"high":11,"name":"Amazon AWS","rank":15,"slug":"aws","score":45,"vendor":{"hub":true,"name":"Amazon","slug":"amazon"},"critical":2,"max_cvss":9.9,"max_epss":null,"exploited":0,"vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/aws"},{"hub":true,"top":[{"cve":"CVE-2026-82894","slug":"cve-2026-82894-improper-authorization-in-contentworker-in-apache-ofbiz-24-09","title":"Apache OFBiz improper authorization in ContentWorker","severity":"info","exploited":false,"published_at":"2026-11-05T15:17:26.98+00:00","url":"https://junglewise.ai/threats/cve-2026-82894-improper-authorization-in-contentworker-in-apache-ofbiz-24-09"},{"cve":"CVE-2026-81828","slug":"cve-2026-81828-server-side-request-forgery-in-surveywrapper-in-apache-ofbiz-24","title":"Apache OFBiz server-side request forgery in SurveyWrapper","severity":"info","exploited":false,"published_at":"2026-11-05T15:17:26.833+00:00","url":"https://junglewise.ai/threats/cve-2026-81828-server-side-request-forgery-in-surveywrapper-in-apache-ofbiz-24"},{"cve":"CVE-2026-81816","slug":"cve-2026-81816-xml-external-entity-xxe-injection-in-contentworker-in-apache","title":"Apache OFBiz XXE injection in ContentWorker","severity":"info","exploited":false,"published_at":"2026-11-05T15:17:26.657+00:00","url":"https://junglewise.ai/threats/cve-2026-81816-xml-external-entity-xxe-injection-in-contentworker-in-apache"}],"high":0,"name":"Apache Ofbiz","rank":16,"slug":"ofbiz","score":43,"vendor":{"hub":true,"name":"Apache","slug":"apache"},"critical":0,"max_cvss":null,"max_epss":null,"exploited":0,"vulnerabilities":43,"url":"https://junglewise.ai/threats/technologies/ofbiz"},{"hub":true,"top":[{"cvss":9.9,"slug":"lxd-has-restricted-project-bypass-leading-to-arbitrary-command-9034cd45","title":"LXD restricted project bypass leading to arbitrary command execution","severity":"critical","exploited":false,"published_at":"2026-11-06T19:51:26+00:00","url":"https://junglewise.ai/threats/lxd-has-restricted-project-bypass-leading-to-arbitrary-command-9034cd45"},{"cvss":9.9,"slug":"lxd-has-arbitrary-file-write-on-client-due-to-trusted-image-hash-072dacee","title":"Incus arbitrary file write via trusted image hash","severity":"critical","exploited":false,"published_at":"2026-11-06T19:36:55+00:00","url":"https://junglewise.ai/threats/lxd-has-arbitrary-file-write-on-client-due-to-trusted-image-hash-072dacee"},{"cvss":9.9,"slug":"lxd-has-argument-injection-in-backup-compression-algorithm-leading-to-50a60f2a","title":"LXD argument injection in backup compression algorithm","severity":"critical","exploited":false,"published_at":"2026-11-06T19:36:37+00:00","url":"https://junglewise.ai/threats/lxd-has-argument-injection-in-backup-compression-algorithm-leading-to-50a60f2a"}],"high":2,"name":"github.com/canonical/lxd (Go)","rank":17,"slug":"github-com-canonical-lxd","score":42,"vendor":{"hub":true,"name":"Go","slug":"go"},"critical":6,"max_cvss":9.9,"max_epss":null,"exploited":0,"vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/github-com-canonical-lxd"},{"hub":true,"top":[{"cve":"CVE-2026-123605","cvss":8.8,"slug":"cve-2026-123605-hickory-dns-hickory-proto-0-1-through-0-25-0-alpha-3-and-hickory","title":"Hickory DNS DNSSEC validation bypass via RRSIG Signer's Name","severity":"high","exploited":false,"published_at":"2026-11-08T02:16:55.423+00:00","url":"https://junglewise.ai/threats/cve-2026-123605-hickory-dns-hickory-proto-0-1-through-0-25-0-alpha-3-and-hickory"},{"cve":"CVE-2026-123596","cvss":8.8,"slug":"cve-2026-123596-hickory-dns-hickory-proto-through-0-26-0-alpha-1-and-hickory-net","title":"Hickory DNS DNSSEC validation bypass in NSEC handler","severity":"high","exploited":false,"published_at":"2026-11-08T02:16:54.02+00:00","url":"https://junglewise.ai/threats/cve-2026-123596-hickory-dns-hickory-proto-through-0-26-0-alpha-1-and-hickory-net"},{"cve":"CVE-2026-123595","cvss":8.8,"slug":"cve-2026-123595-hickory-dns-hickory-proto-0-25-through-0-26-0-alpha-1-and","title":"Hickory DNS DNSSEC validation bypass in NSEC3 handler","severity":"high","exploited":false,"published_at":"2026-11-08T02:16:53.863+00:00","url":"https://junglewise.ai/threats/cve-2026-123595-hickory-dns-hickory-proto-0-25-through-0-26-0-alpha-1-and"}],"high":10,"name":"Hickory-Dns Hickory-Proto","rank":18,"slug":"hickory-dns-hickory-proto","score":38,"vendor":{"hub":true,"name":"Hickory-Dns","slug":"hickory-dns"},"critical":0,"max_cvss":8.8,"max_epss":null,"exploited":0,"vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/hickory-dns-hickory-proto"},{"hub":true,"top":[{"cve":"CVE-2026-85295","cvss":9.8,"slug":"cve-2026-85295-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew authentication bypass via legacy session tokens","severity":"critical","exploited":false,"published_at":"2026-11-06T21:17:10.89+00:00","url":"https://junglewise.ai/threats/cve-2026-85295-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-54349","cvss":9.8,"slug":"cve-2026-54349-chartbrew-is-an-open-source-web-application-that-can-connect","title":"Chartbrew SQL injection via dashboard variable substitution","severity":"critical","exploited":false,"published_at":"2026-11-06T21:17:08.947+00:00","url":"https://junglewise.ai/threats/cve-2026-54349-chartbrew-is-an-open-source-web-application-that-can-connect"},{"cve":"CVE-2026-68935","cvss":9.1,"slug":"cve-2026-68935-chartbrew-is-an-open-source-web-application-for-creating-charts","title":"Chartbrew API connection private host bypass","severity":"critical","exploited":false,"published_at":"2026-11-06T22:17:59.39+00:00","url":"https://junglewise.ai/threats/cve-2026-68935-chartbrew-is-an-open-source-web-application-for-creating-charts"}],"high":5,"name":"Chartbrew","rank":19,"slug":"chartbrew-chartbrew","score":36,"vendor":{"hub":true,"name":"Chartbrew","slug":"chartbrew"},"critical":3,"max_cvss":9.8,"max_epss":null,"exploited":0,"vulnerabilities":11,"url":"https://junglewise.ai/threats/technologies/chartbrew-chartbrew"},{"hub":true,"top":[{"cve":"CVE-2026-123531","cvss":8.8,"slug":"cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled","title":"Vikunja denial of service via pagination bypass in API v1","severity":"high","exploited":false,"published_at":"2026-11-08T02:16:43.19+00:00","url":"https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled"},{"cve":"CVE-2026-123522","cvss":7.1,"slug":"cve-2026-123522-vikunja-before-2-7-1-contains-an-authorization-bypass","title":"Vikunja authorization bypass in Kanban task webhook","severity":"high","exploited":false,"published_at":"2026-11-08T02:16:41.607+00:00","url":"https://junglewise.ai/threats/cve-2026-123522-vikunja-before-2-7-1-contains-an-authorization-bypass"},{"cve":"CVE-2026-123520","cvss":7.1,"slug":"cve-2026-123520-vikunja-from-0-18-0-before-2-7-1-contains-a-privilege-escalation","title":"Vikunja privilege escalation via account deletion","severity":"high","exploited":false,"published_at":"2026-11-08T02:16:41.247+00:00","url":"https://junglewise.ai/threats/cve-2026-123520-vikunja-from-0-18-0-before-2-7-1-contains-a-privilege-escalation"}],"high":3,"name":"Vikunja","rank":20,"slug":"vikunja","score":35,"vendor":{"hub":true,"name":"Vikunja","slug":"vikunja"},"critical":0,"max_cvss":8.8,"max_epss":null,"exploited":0,"vulnerabilities":29,"url":"https://junglewise.ai/threats/technologies/vikunja"},{"hub":true,"top":[{"cve":"CVE-2026-123279","cvss":9,"slug":"cve-2026-123279-in-jetbrains-datalore-before-2026-4-code-execution-was-possible","title":"JetBrains Datalore code execution in notebook computation","severity":"critical","exploited":false,"published_at":"2026-11-06T11:17:06.14+00:00","url":"https://junglewise.ai/threats/cve-2026-123279-in-jetbrains-datalore-before-2026-4-code-execution-was-possible"},{"cve":"CVE-2026-123836","cvss":8.8,"slug":"cve-2026-123836-in-jetbrains-datalore-before-2026-4-workspace-collaborators","title":"JetBrains Datalore SSH private key exposure in Git backup","severity":"high","exploited":false,"published_at":"2026-11-06T17:17:21.963+00:00","url":"https://junglewise.ai/threats/cve-2026-123836-in-jetbrains-datalore-before-2026-4-workspace-collaborators"},{"cve":"CVE-2026-123280","cvss":8.1,"slug":"cve-2026-123280-in-jetbrains-datalore-before-2026-2-4-unauthenticated-users","title":"JetBrains Datalore unauthenticated code execution via published reports","severity":"high","exploited":false,"published_at":"2026-11-06T11:17:06.27+00:00","url":"https://junglewise.ai/threats/cve-2026-123280-in-jetbrains-datalore-before-2026-2-4-unauthenticated-users"}],"high":5,"name":"Jetbrains Datalore","rank":21,"slug":"datalore","score":31,"vendor":{"hub":true,"name":"Jetbrains","slug":"jetbrains"},"critical":1,"max_cvss":9,"max_epss":null,"exploited":0,"vulnerabilities":16,"url":"https://junglewise.ai/threats/technologies/datalore"},{"hub":true,"top":[{"cve":"CVE-2026-120281","cvss":10,"slug":"cve-2026-120281-a-vulnerability-was-found-in-wavlink-wn536ax6-a-v260507-this","title":"WAVLINK WN536AX6-A stack buffer overflow in OpenVPN handler","severity":"critical","exploited":false,"published_at":"2026-11-02T01:17:27.07+00:00","url":"https://junglewise.ai/threats/cve-2026-120281-a-vulnerability-was-found-in-wavlink-wn536ax6-a-v260507-this"},{"cve":"CVE-2026-120279","cvss":10,"slug":"cve-2026-120279-a-flaw-has-been-found-in-wavlink-wn536ax6-a-v260507-the-affected","title":"WAVLINK WN536AX6 OS command injection in OpenVPN handler","severity":"critical","exploited":false,"published_at":"2026-11-02T01:17:26.677+00:00","url":"https://junglewise.ai/threats/cve-2026-120279-a-flaw-has-been-found-in-wavlink-wn536ax6-a-v260507-the-affected"},{"cve":"CVE-2026-120277","cvss":10,"slug":"cve-2026-120277-a-security-vulnerability-has-been-detected-in-wavlink-wn536ax6-a","title":"WAVLINK WN536AX6-A OS command injection in WireGuard CLI handler","severity":"critical","exploited":false,"published_at":"2026-11-02T00:18:10.81+00:00","url":"https://junglewise.ai/threats/cve-2026-120277-a-security-vulnerability-has-been-detected-in-wavlink-wn536ax6-a"}],"high":0,"name":"Wavlink WN536AX6-A","rank":22,"slug":"wn536ax6-a","score":31,"vendor":{"hub":true,"name":"Wavlink","slug":"wavlink"},"critical":5,"max_cvss":10,"max_epss":null,"exploited":0,"vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/wn536ax6-a"},{"hub":true,"top":[{"cve":"CVE-2026-13292","cvss":8.8,"slug":"cve-2026-13292-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts","title":"IBM MQ Managed File Transfer arbitrary code execution via environment variables","severity":"high","exploited":false,"published_at":"2026-11-04T21:18:12.29+00:00","url":"https://junglewise.ai/threats/cve-2026-13292-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts"},{"cve":"CVE-2026-11376","cvss":8.8,"slug":"cve-2026-11376-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts","title":"IBM MQ integer overflow in subscription request processing","severity":"high","exploited":false,"published_at":"2026-11-04T21:17:56.403+00:00","url":"https://junglewise.ai/threats/cve-2026-11376-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts"},{"cve":"CVE-2026-11724","cvss":8.5,"slug":"cve-2026-11724-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts","title":"IBM MQ arbitrary code execution in Managed File Transfer","severity":"high","exploited":false,"published_at":"2026-11-04T21:17:56.573+00:00","url":"https://junglewise.ai/threats/cve-2026-11724-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts"}],"high":9,"name":"IBM Mq","rank":23,"slug":"mq","score":29,"vendor":{"hub":true,"name":"IBM","slug":"ibm"},"critical":0,"max_cvss":8.8,"max_epss":null,"exploited":0,"vulnerabilities":11,"url":"https://junglewise.ai/threats/technologies/mq"},{"hub":true,"top":[{"cve":"CVE-2026-123551","cvss":10,"slug":"cve-2026-123551-openam-from-14-0-0-before-16-1-4-contains-an-information","title":"OpenAM unauthenticated session token disclosure via WebSocket","severity":"critical","exploited":false,"published_at":"2026-11-08T02:16:46.603+00:00","url":"https://junglewise.ai/threats/cve-2026-123551-openam-from-14-0-0-before-16-1-4-contains-an-information"},{"cve":"CVE-2026-123550","cvss":9.8,"slug":"cve-2026-123550-openam-before-16-1-4-contains-an-authentication-bypass","title":"OpenAM SAML v2.0 service provider authentication bypass","severity":"critical","exploited":false,"published_at":"2026-11-08T02:16:46.41+00:00","url":"https://junglewise.ai/threats/cve-2026-123550-openam-before-16-1-4-contains-an-authentication-bypass"},{"cve":"CVE-2026-123549","cvss":9.8,"slug":"cve-2026-123549-openam-before-16-1-4-fails-to-enforce-the-valid-creation","title":"OpenAM self-registration attribute list enforcement bypass","severity":"critical","exploited":false,"published_at":"2026-11-08T02:16:46.247+00:00","url":"https://junglewise.ai/threats/cve-2026-123549-openam-before-16-1-4-fails-to-enforce-the-valid-creation"}],"high":0,"name":"Open Identity Platform OpenAM","rank":24,"slug":"openam","score":28,"vendor":{"hub":true,"name":"Open Identity Platform","slug":"open-identity-platform"},"critical":3,"max_cvss":10,"max_epss":null,"exploited":0,"vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/openam"},{"hub":true,"top":[{"cve":"CVE-2026-68591","slug":"cve-2026-68591-in-modem-there-is-a-possible-escalation-of-privilege-due-to-a","title":"MediaTek Modem privilege escalation via permissions bypass","severity":"info","exploited":false,"published_at":"2026-11-02T03:17:38.343+00:00","url":"https://junglewise.ai/threats/cve-2026-68591-in-modem-there-is-a-possible-escalation-of-privilege-due-to-a"},{"cve":"CVE-2026-68589","slug":"cve-2026-68589-in-modem-there-is-a-possible-out-of-bounds-write-due-to-a-missing","title":"MediaTek Modem out-of-bounds write privilege escalation","severity":"info","exploited":false,"published_at":"2026-11-02T03:17:38.087+00:00","url":"https://junglewise.ai/threats/cve-2026-68589-in-modem-there-is-a-possible-out-of-bounds-write-due-to-a-missing"},{"cve":"CVE-2026-68588","slug":"cve-2026-68588-in-modem-there-is-a-possible-way-for-xxx-to-xxxxx-due-to-an","title":"MediaTek Modem integer overflow denial of service","severity":"info","exploited":false,"published_at":"2026-11-02T03:17:37.95+00:00","url":"https://junglewise.ai/threats/cve-2026-68588-in-modem-there-is-a-possible-way-for-xxx-to-xxxxx-due-to-an"}],"high":0,"name":"MediaTek Modem","rank":25,"slug":"modem","score":27,"vendor":{"hub":true,"name":"MediaTek","slug":"mediatek"},"critical":0,"max_cvss":null,"max_epss":null,"exploited":0,"vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/modem"}],"previous":{"key":"2026-10-26","top":"Apple macOS Golden Gate","period":{"end":"2026-11-01","start":"2026-10-26"},"totals":{"high":749,"tracked":6763,"critical":198,"exploited":2,"technologies":1973,"vulnerabilities":3708},"url":"https://junglewise.ai/threats/weekly/2026-10-26"},"next":null}