Possible (1 to 10%)

Every one of the 266 is a mark on the map. Named now: 1 to 26, most at risk first.

1. exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via…CVE-2011-0708Php · 9.8% likely

   CWE-119PHP

2. Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before…CVE-2011-1290Apple · 9.8% likely

   CWE-189Apple

3. The Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a ziparchive stream that is not properly handled by t…CVE-2011-1470Php · 9.5% likely

   CWE-20PHP

4. The remote console in the Server Controller in IBM Lotus Domino 7.x and 8.x verifies credentials against a file located at a UNC share pathname specified by the client, which allo…CVE-2011-1519Ibm · 9.2% likely

   CWE-287IBM

5. epan/dissectors/packet-ntlmssp.c in the NTLMSSP dissector in Wireshark before 1.4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application…CVE-2011-1143Wireshark · 8.6% likely

   Wireshark

6. Double free vulnerability in the prepare_error_as function in do_as_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 through 1.9, when the PKINIT featur…CVE-2011-0284Mit · 8.3% likely

   CWE-399Mit

7. The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and o…CVE-2010-4755Openbsd · 7.8% likely

   CWE-399Openbsd

8. Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers t…CVE-2011-0192Apple · 7.5% likely

   CWE-119Apple

9. libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an NSV file.CVE-2010-3276Videolan · 7.5% likely

   CWE-119Videolan

10. Use-after-free vulnerability in the JSON.stringify method in js3250.dll in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote a…CVE-2011-0055Mozilla · 7.2% likely

    CWE-399Mozilla

11. Untrusted search path vulnerability in the client in Microsoft Remote Desktop Connection 5.2, 6.0, 6.1, and 7.0 allows local users to gain privileges via a Trojan horse DLL in the…CVE-2011-0029Microsoft · CVSS 7.4 · 7.2% likely

    Microsoft

12. Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from proce…CVE-2011-1153Php · 6.8% likely

    CWE-134PHP

13. Buffer overflow in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbi…CVE-2011-0191Apple · 6.7% likely

    CWE-119Apple

14. Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access res…CVE-2011-1419Apache · 6.5% likely

    Apache

15. Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web applic…CVE-2011-1088Apache · 6.5% likely

    Apache

16. The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereferenc…CVE-2011-0715Apache · 6.3% likely

    Apache

17. SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to dis…CVE-2011-0745Sugarcrm · 6.3% likely

    CWE-20Sugarcrm

18. Heap-based buffer overflow in the thunder (aka ThunderScan) decoder in tif_thunder.c in LibTIFF 3.9.4 and earlier allows remote attackers to execute arbitrary code via crafted THU…CVE-2011-1167Libtiff · 6.2% likely

    CWE-119Libtiff

19. Use-after-free vulnerability in WebKit, as used in Apple Safari before 5.0.5; iOS before 4.3.2 for iPhone, iPod, and iPad; iOS before 4.2.7 for iPhone 4 (CDMA); and possibly other…CVE-2011-1344Apple · 6.1% likely

    CWE-399Apple

20. Unspecified vulnerability in Novell Vibe OnPrem 3.0 before Hot Patch 1 allows remote attackers to execute arbitrary code via unknown vectors.CVE-2011-0464Novell · 6.0% likely

    Novell

21. Integer overflow in the SdnToJulian function in the Calendar extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via…CVE-2011-1466Php · 5.9% likely

    CWE-189PHP

22. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 allow re…CVE-2011-0053Mozilla · 5.8% likely

    Mozilla

23. Buffer overflow in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, on Windows allows remote attackers to execute arbitrary code or cause a deni…CVE-2011-0058Mozilla · 5.5% likely

    CWE-119Mozilla

24. Integer overflow in QuickLook, as used in Apple Mac OS X before 10.6.7 and MobileSafari in Apple iOS before 4.2.7 and 4.3.x before 4.3.2, allows remote attackers to execute arbitr…CVE-2011-1417Apple · 5.5% likely

    CWE-189Apple

25. Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) vi…CVE-2011-1554T1lib · 5.4% likely

    CWE-189T1lib

26. Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (applicati…CVE-2011-1553T1lib · 5.4% likely

    CWE-399T1lib

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.