Possible (1 to 10%)

Every one of the 266 is a mark on the map. Named now: 1 to 26, most at risk first.

1. The resolver in the DNS Server service in Microsoft Windows Server 2008 before R2 overwrites cached server names and TTL values in NS records during the processing of a response t…CVE-2012-1194Microsoft · 9.7% likely

   Microsoft

2. Directory traversal vulnerability in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels…CVE-2011-4876Siemens · 9.0% likely

   CWE-22Siemens

3. actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HT…CVE-2012-1011Likno · 9.0% likely

   CWE-264

4. Unspecified vulnerability in HP Network Automation 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to execute arbitrary code via unknown vectors.CVE-2011-4790Hp · 9.0% likely

   HP

5. Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP…CVE-2012-1010Likno · 8.9% likely

   CWE-20

6. Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Andr…CVE-2012-0752Adobe · 8.8% likely

   CWE-843Adobe

7. The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) v…CVE-2012-0788Php · 8.6% likely

   CWE-20PHP

8. DBServer.exe in HP Data Protector Media Operations 6.11 and earlier allows remote attackers to execute arbitrary code via a crafted request containing a large value in a length fi…CVE-2011-4791Hp · 8.2% likely

   CWE-94HP

9. Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls…CVE-2012-0789Php · 8.0% likely

   CWE-399PHP

10. Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures,…CVE-2012-0444Mozilla · 7.8% likely

    CWE-119Mozilla

11. HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panel…CVE-2011-4877Siemens · 7.3% likely

    CWE-20Siemens

12. Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string.CVE-2012-0242Advantech · 6.9% likely

    CWE-134Advantech

13. The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and application cr…CVE-2006-7250Openssl · 6.7% likely

    OpenSSL

14. PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote at…CVE-2012-0831Php · 6.5% likely

    CWE-20PHP

15. Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the BlackBerry PlayBook tablet before 2.0.0.7971 and other products, allows re…CVE-2012-0870Samba · 6.4% likely

    CWE-119Samba

16. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_3…CVE-2012-0499Oracle · 6.2% likely

    Oracle

17. Heap-based buffer overflow in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code via unspecified vectors.CVE-2012-0758Adobe · 5.9% likely

    CWE-119Adobe

18. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows r…CVE-2012-0498Oracle · 5.8% likely

    Oracle

19. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, and 6 Update 30 and earlier, allows remote attackers to affect…CVE-2012-0497Oracle · 5.8% likely

    Oracle

20. Absolute path traversal vulnerability in file in Enigma2 Webinterface 1.6.0 through 1.6.8, 1.6rc3, and 1.7.0 allows remote attackers to read arbitrary files via a full pathname in…CVE-2012-1025Dream-Multimedia-Tv · 5.7% likely

    CWE-22

21. Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (mem…CVE-2012-0449Mozilla · 5.7% likely

    CWE-119Mozilla

22. The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, whi…CVE-2012-1193Powerdns · 5.6% likely

    PowerDNS

23. PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and develo…CVE-2011-4614Typo3 · 5.5% likely

    CWE-94Typo3

24. The server in IBM solidDB 6.5 before Interim Fix 6 does not properly initialize data structures, which allows remote authenticated users to cause a denial of service (daemon crash…CVE-2012-0200Ibm · 5.4% likely

    IBM

25. Stack-based buffer overflow in jp2_x.dll in LuraWave JP2 ActiveX Control 2.1.5.5 and other versions before 2.1.5.11 allows remote attackers to execute arbitrary code via a JPEG200…CVE-2012-0977Luratech · 5.1% likely

    CWE-119

26. base_ag_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allows remote attackers to execute arbitrary code by uploading contents of the file with an executable extensio…CVE-2012-1198Secureideas · 5.0% likely

    CWE-20Secureideas

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.