Likely to be exploited (10% or more)

Every one of the 35 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrar…CVE-2012-2763Gimp · 82% likely

   CWE-120GIMP

2. The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary commands via crafted input to application scripts.CVE-2012-2953Symantec · 67% likely

   CWE-78Symantec

3. SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL…CVE-2012-2962Sonicwall · 67% likely

   CWE-89SonicWall

4. Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.CVE-2012-3399Artis.imag · 65% likely

   CWE-20

5. Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1326.CVE-2012-2020Hp · 65% likely

   HP

6. Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1325.CVE-2012-2019Hp · 64% likely

   HP

7. TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/ban…CVE-2012-0911Tiki · 63% likely

   CWE-502Tiki

8. F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-…CVE-2012-1493F5 · 63% likely

   CWE-255F5

9. Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release an…CVE-2012-3811Avaya · 63% likely

   Avaya

10. The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows local users to gain privileges by modifying files, related to a "file inclusion" issue.CVE-2012-2957Symantec · 59% likely

    CWE-264Symantec

11. Multiple directory traversal vulnerabilities in src/acloglogin.php in Wangkongbao CNS-1000 and 1100 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) la…CVE-2012-4031Wangkongbao · 52% likely

    CWE-22

12. The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote acco…CVE-2012-3951Sonicwall · 52% likely

    CWE-89SonicWall

13. Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration…CVE-2011-2657Novell · 48% likely

    CWE-22Novell

14. cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows remote attackers to ad…CVE-2012-2626Sonicwall · 44% likely

    CWE-287SonicWall

15. Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service…CVE-2012-2386Php · 42% likely

    CWE-189PHP

16. An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy H…CVE-2012-2516Ge · 39% likely

    CWE-78Ge

17. Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireless-G PTZ Internet video camera…CVE-2012-0284Cisco · 36% likely

    CWE-119Cisco

18. Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary co…CVE-2012-1891Microsoft · CVSS 9.8 · 29% likely

    CWE-908Microsoft

19. Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component), as used in EMC Docu…CVE-2012-2515Emc · 27% likely

    CWE-119Emc

20. The Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attack…CVE-2012-0175Microsoft · CVSS 8.8 · 26% likely

    CWE-94Microsoft

21. ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitr…CVE-2012-1661Esri · 24% likely

    CWE-94Esri

22. ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does no…CVE-2012-3817Isc · 24% likely

    CWE-20Isc

23. Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 al…CVE-2012-1863Microsoft · 23% likely

    CWE-79Microsoft

24. Cross-site scripting (XSS) vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gol…CVE-2012-1859Microsoft · 23% likely

    CWE-79Microsoft

25. Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Attribute Rem…CVE-2012-1524Microsoft · 22% likely

    CWE-94Microsoft

26. Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Cached Object…CVE-2012-1522Microsoft · 21% likely

    CWE-94Microsoft

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.