Possible (1 to 10%)

Every one of the 149 is a mark on the map. Named now: 1 to 26, most at risk first.

1. The IP-HTTPS server in Windows Server 2008 R2 and R2 SP1 and Server 2012 does not properly validate certificates, which allows remote attackers to bypass intended access restricti…CVE-2012-2549Microsoft · 10.0% likely

   CWE-20Microsoft

2. org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CS…CVE-2012-4431Apache · 9.1% likely

   CWE-264Apache

3. Buffer overflow in Adobe Photoshop Camera Raw before 7.3 allows attackers to execute arbitrary code via unspecified vectors.CVE-2012-5680Adobe · 8.5% likely

   CWE-119Adobe

4. Buffer overflow in Adobe Flash Player before 10.3.183.48 and 11.x before 11.5.502.135 on Windows, before 10.3.183.48 and 11.x before 11.5.502.136 on Mac OS X, before 10.3.183.48 a…CVE-2012-5676Adobe · 8.3% likely

   CWE-119Adobe

5. simple-gmail-login.php in the Simple Gmail Login plugin before 1.1.4 for WordPress allows remote attackers to obtain sensitive information via a request that lacks a timezone, lea…CVE-2012-6313Simple Gmail Login · 7.7% likely

   CWE-200

6. org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows…CVE-2012-4534Apache · 7.5% likely

   CWE-399Apache

7. The pa_modify_accounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modifyAccounts method, wh…CVE-2012-5930Microfocus · 7.4% likely

   CWE-287Micro Focus

8. Directory traversal vulnerability in the set_log_config function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated u…CVE-2012-5931Microfocus · 7.3% likely

   CWE-22Micro Focus

9. Integer overflow in Adobe Flash Player before 10.3.183.48 and 11.x before 11.5.502.135 on Windows, before 10.3.183.48 and 11.x before 11.5.502.136 on Mac OS X, before 10.3.183.48…CVE-2012-5677Adobe · 6.9% likely

   CWE-189Adobe

10. Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attackers to cause a denial of service (crash) and possibly execu…CVE-2012-5576Gimp · 6.8% likely

    CWE-787GIMP

11. The Browser application in Android 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted market: URI in the SRC attribute of an IFRAME eleme…CVE-2012-6301Google · 6.4% likely

    CWE-20Google

12. Heap-based buffer overflow in iconvert.c in the bogolexer component in Bogofilter before 1.2.3 allows remote attackers to cause a denial of service (crash) and possibly execute ar…CVE-2012-5468Bogofilter Project · 6.3% likely

    CWE-119Bogofilter

13. The XML Service interface in Citrix XenApp 6.5 and 6.5 Feature Pack 1 allows remote attackers to execute arbitrary code via unspecified vectors.CVE-2012-5161Citrix · 5.7% likely

    Citrix (NetScaler)

14. screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote authenticated users to cause a denial of service (device rel…CVE-2012-5991Cisco · 5.5% likely

    Cisco

15. Adobe Flash Player before 10.3.183.48 and 11.x before 11.5.502.135 on Windows, before 10.3.183.48 and 11.x before 11.5.502.136 on Mac OS X, before 10.3.183.48 and 11.x before 11.2…CVE-2012-5678Adobe · 5.4% likely

    CWE-119Adobe

16. Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possibly other versions including 5.5.x before 5.5.22 and 5.1.x before 5.1.62, allows remote attackers to execute arbitrary c…CVE-2012-0882Mysql · 5.3% likely

    CWE-119Mysql

17. Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attacker…CVE-2012-5195Perl · 4.9% likely

    CWE-119Perl

18. Buffer underflow in Adobe Photoshop Camera Raw before 7.3 allows attackers to execute arbitrary code via unspecified vectors.CVE-2012-5679Adobe · 4.8% likely

    CWE-119Adobe

19. CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTT…CVE-2011-2732Vmware · 4.6% likely

    CWE-94VMware

20. Buffer overflow in IBM Informix 11.50 through 11.50.xC9W2 and 11.70 before 11.70.xC7 allows remote authenticated users to execute arbitrary code via a crafted SQL statement.CVE-2012-4857Ibm · 4.6% likely

    CWE-119IBM

21. Multiple directory traversal vulnerabilities in Axway SecureTransport 5.1 SP2 and earlier allow remote authenticated users to (1) read, (2) delete, or (3) create files, or (4) lis…CVE-2012-4991Axway · 4.6% likely

    CWE-22Axway

22. The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a pl…CVE-2012-5534Flashtux · 4.4% likely

    CWE-20

23. Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows remote attackers to execute arbitrary commands via unknown…CVE-2012-5955Ibm · 4.4% likely

    IBM

24. Unspecified vulnerability in Novell iPrint Client before 5.82 allows remote attackers to execute arbitrary code via an op-client-interface-version action.CVE-2012-0411Novell · 4.3% likely

    Novell

25. Samsung Kies Air 2.1.207051 and 2.1.210161 relies on the IP address for authentication, which allows remote man-in-the-middle attackers to read arbitrary phone contents by spoofin…CVE-2012-5858Samsung · 4.3% likely

    CWE-287Samsung

26. Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine AssetExplorer 5.6 before service pack 5614 allow remote attackers to inject arbitrary web script or HTML via fi…CVE-2012-5956Zohocorp · 4.1% likely

    CWE-79Zoho (ManageEngine)

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.