Likely to be exploited (10% or more)

Every one of the 27 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, an…CVE-2012-5088Oracle · 79% likely

   Oracle

2. Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows remote attackers to execute arbitrary code via…CVE-2011-5227Enterasys · 77% likely

   CWE-119Enterasys

3. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect…CVE-2012-1533Oracle · 69% likely

   Oracle

4. Microsoft Word 2007 SP2 and SP3 does not properly handle memory during the parsing of Word documents, which allows remote attackers to execute arbitrary code via a crafted documen…CVE-2012-0182Microsoft · 67% likely

   CWE-94Microsoft

5. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality via unknown ve…CVE-2012-5067Oracle · 64% likely

   Oracle

6. Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors.CVE-2011-4929Redmine · 46% likely

   Redmine

7. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_3…CVE-2012-5081Oracle · 45% likely

   Oracle

8. The rtrlet web application in the Web Console in Novell ZENworks Asset Management (ZAM) 7.5 uses a hard-coded username of Ivanhoe and a hard-coded password of Scott for the (1) Ge…CVE-2012-4933Novell · 44% likely

   CWE-255Novell

9. The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and Sea…CVE-2012-3993Mozilla · 43% likely

   CWE-269Mozilla

10. The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP cod…CVE-2012-5223Crawlability · 41% likely

    CWE-94

11. Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3…CVE-2012-2520Microsoft · 34% likely

    CWE-79Microsoft

12. ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (name…CVE-2012-5166Isc · 33% likely

    CWE-189Isc

13. Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file wit…CVE-2012-1153Apprain · 32% likely

    appRain

14. The server in Kerberos in Microsoft Windows Server 2008 R2 and R2 SP1, and Windows 7 Gold and SP1, allows remote attackers to cause a denial of service (NULL pointer dereference a…CVE-2012-2551Microsoft · 27% likely

    Microsoft

15. Mutiny Standard before 4.5-1.12 allows remote attackers to execute arbitrary commands via the network-interface menu, related to a "command injection vulnerability."CVE-2012-3001Mutiny · 27% likely

    CWE-78

16. Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors.CVE-2012-5692Invisioncommunity · 26% likely

    Invisioncommunity

17. Microsoft Works 9 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted Word .doc file, aka "Works Heap Vulnerabili…CVE-2012-2550Microsoft · 22% likely

    CWE-119Microsoft

18. Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft…CVE-2012-2528Microsoft · 22% likely

    CWE-399Microsoft

19. Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Services SP2 and SQL Server 2005 SP4, 2008 SP2 and SP3, 2008 R2 SP…CVE-2012-2552Microsoft · 16% likely

    CWE-79Microsoft

20. Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8,…CVE-2012-4188Mozilla · 15% likely

    CWE-119Mozilla

21. Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 1…CVE-2012-4186Mozilla · 15% likely

    CWE-119Mozilla

22. Stack-based buffer overflow in the guac_client_plugin_open function in libguac in Guacamole before 0.6.3 allows remote attackers to cause a denial of service (crash) or execute ar…CVE-2012-4415Guac-Dev · 14% likely

    CWE-119

23. Microsoft Excel Viewer (aka Xlview.exe) and Excel in Microsoft Office 2007 (aka Office 12) allow remote attackers to cause a denial of service (read access violation and applicati…CVE-2012-5672Microsoft · 13% likely

    Microsoft

24. Stack-based buffer overflow in the SelectDirectory method in DcsCliCtrl.dll in Camera Stream Client ActiveX Control, as used in D-Link DCS-5605 PTZ IP Network Camera, allows remot…CVE-2012-5306Dlink · 12% likely

    CWE-119D-Link

25. The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML e…CVE-2012-4399Cakefoundation · 12% likely

    CWE-611

26. Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to execute arbitrary co…CVE-2012-1125Kishore Asokan · 12% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.