Possible (1 to 10%)

Every one of the 250 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code…CVE-2014-3176Google · 9.8% likely

   CWE-94Google

2. Siemens SIMATIC S7-1500 CPU devices with firmware before 1.6 allow remote attackers to cause a denial of service (device restart and STOP transition) via crafted TCP packets.CVE-2014-5074Siemens · 9.7% likely

   Siemens

3. org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname match…CVE-2014-3577Apache · 9.2% likely

   Apache

4. The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field…CVE-2014-3596Apache · 9.2% likely

   Apache

5. Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. (dot dot) i…CVE-2014-1222Vtiger · 8.8% likely

   CWE-22Vtiger

6. Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow…CVE-2014-0232Apache · 8.2% likely

   CWE-79Apache

7. Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x th…CVE-2014-4345Mit · 8.1% likely

   CWE-189Mit

8. systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to execute arbitrary commands via shell met…CVE-2014-3085Ibm · 7.6% likely

   CWE-78IBM

9. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 o…CVE-2014-0538Adobe · 7.6% likely

   Adobe1 bounty report

10. Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier…CVE-2014-3528Apache · 7.4% likely

    CWE-255Apache

11. Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via unknown vectors.CVE-2014-2630Hp · 7.1% likely

    HP

12. The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to caus…CVE-2014-4344Mit · 6.6% likely

    CWE-476Mit

13. Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before 1.2.0 for WordPress has unspecified impact and attack vectors.CVE-2012-6653All Video Gallery Plugin Project · 6.5% likely
14. Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.…CVE-2014-4343Mit · 6.4% likely

    CWE-415Mit

15. Unspecified vulnerability in the server in HP Service Manager (SM) 7.21 and 9.x before 9.34 allows remote attackers to bypass intended access restrictions, and modify data or caus…CVE-2014-2634Hp · 6.4% likely

    HP

16. Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTM…CVE-2014-5345Disqus · 6.1% likely

    CWE-79

17. Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the r…CVE-2012-0938Testlink · 5.8% likely

    CWE-89Testlink

18. The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of servic…CVE-2014-5077Linux · 5.8% likely

    CWE-476Linux

19. Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14…CVE-2014-0541Adobe · 5.6% likely

    CWE-264Adobe

20. The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field…CVE-2014-3522Apache · 5.6% likely

    CWE-297Apache

21. The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.0.0 before 5.0.8 on FortiGate devices allows remote attackers to cause a denial of service and possibly e…CVE-2014-2216Fortinet · 5.1% likely

    Fortinet

22. Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows remote attackers to gain pr…CVE-2014-3086Ibm · 5.1% likely

    IBM

23. Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of adm…CVE-2014-5347Disqus · 4.9% likely

    CWE-352

24. Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter. NOTE…CVE-2013-6771Splunk · 4.8% likely

    CWE-22Splunk

25. The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exist…CVE-2014-3341Cisco · 4.7% likely

    CWE-200Cisco

26. IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of…CVE-2014-3429Ipython · 4.7% likely

    CWE-94Ipython

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.