Possible (1 to 10%)

Every one of the 418 is a mark on the map. Named now: 1 to 26, most at risk first.

1. The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environme…CVE-2015-5161Zend · 9.9% likely

   Zend

2. Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and…CVE-2015-3269Adobe · 9.8% likely

   CWE-200Adobe

3. Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of serv…CVE-2014-1972Apache · 9.6% likely

   CWE-399Apache

4. Unspecified vulnerability in HP Operations Manager i (OMi) 9.22, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote attackers to execute arbitrary code via unknown vectors.CVE-2015-2137Hp · 9.6% likely

   HP

5. The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connectio…CVE-2015-5600Openbsd · CVSS 8.1 · 9.4% likely

   CWE-400Openbsd

6. runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 does not properly drop privileges, which allows attackers to execute arbitrary c…CVE-2015-5784Apple · 9.0% likely

   CWE-264Apple

7. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a diff…CVE-2015-4935Ibm · 9.0% likely

   CWE-119IBM

8. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a diff…CVE-2015-4934Ibm · 9.0% likely

   CWE-119IBM

9. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a diff…CVE-2015-4933Ibm · 9.0% likely

   CWE-119IBM

10. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a diff…CVE-2015-4932Ibm · 9.0% likely

    CWE-119IBM

11. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a diff…CVE-2015-4931Ibm · 9.0% likely

    CWE-119IBM

12. Unspecified vulnerability in HP Intelligent Provisioning 1.00 through 1.62(a), 2.00, and 2.10 allows remote attackers to execute arbitrary code via unknown vectors.CVE-2015-2135Hp · 8.9% likely

    HP

13. Cross-site scripting (XSS) vulnerability in Microsoft System Center 2012 Operations Manager Gold before Rollup 8, SP1 before Rollup 10, and R2 before Rollup 7 allows remote attack…CVE-2015-2420Microsoft · 8.8% likely

    CWE-79Microsoft

14. mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote ano…CVE-2015-3184Apache · 8.8% likely

    CWE-200Apache

15. Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux…CVE-2015-4491Gnome · 8.4% likely

    CWE-189Gnome

16. The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which a…CVE-2015-6524Apache · 8.2% likely

    CWE-255Apache

17. Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio ch…CVE-2015-4479Mozilla · 8.2% likely

    CWE-189Mozilla

18. Dell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request.CVE-2015-5696Dell · 8.2% likely

    CWE-20Dell

19. Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute…CVE-2015-4497Mozilla · 8.0% likely

    Mozilla

20. WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leve…CVE-2015-5623Wordpress · 7.7% likely

    CWE-284WordPress

21. Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbi…CVE-2015-4485Mozilla · 7.7% likely

    CWE-119Mozilla

22. Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long USER command.CVE-2015-6750Ricoh · 7.7% likely

    CWE-119Ricoh

23. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0…CVE-2015-5559Adobe · 7.6% likely

    Adobe

24. Race condition in runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged con…CVE-2015-5754Apple · 7.4% likely

    CWE-362Apple

25. Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTM…CVE-2015-3438Wordpress · 7.4% likely

    CWE-79WordPress

26. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attacker…CVE-2015-2430Microsoft · 7.2% likely

    CWE-264Microsoft

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.