Likely to be exploited (10% or more)

Every one of the 49 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confi…CVE-2016-0492Oracle · 92% likely

   Oracle

2. ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP…CVE-2015-8605Isc · 83% likely

   CWE-20Isc

3. Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integ…CVE-2016-0491Oracle · 80% likely

   Oracle

4. Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows…CVE-2016-0854Advantech · 77% likely

   Advantech

5. Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4…CVE-2016-1909Fortinet · 71% likely

   CWE-264Fortinet

6. Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confi…CVE-2016-0488Oracle · 65% likely

   Oracle

7. The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by…CVE-2016-0777Openbsd · CVSS 6.5 · 63% likely

   CWE-200Openbsd

8. Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// pro…CVE-2015-5259Apache · 57% likely

   CWE-119Apache

9. Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote authenticated users to af…CVE-2016-0489Oracle · 55% likely

   Oracle

10. Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.CVE-2015-8279Samsung · 51% likely

    CWE-264Samsung

11. Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confi…CVE-2016-0487Oracle · 51% likely

    Oracle

12. DirectShow in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511…CVE-2016-0015Microsoft · 49% likely

    CWE-119Microsoft

13. Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted seriali…CVE-2015-5254Apache · 38% likely

    CWE-20Apache

14. Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, aka "Microsoft Edge Memory Corruption Vulnerability."CVE-2016-0003Microsoft · 38% likely

    CWE-119Microsoft

15. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Go…CVE-2016-0016Microsoft · 30% likely

    CWE-426Microsoft

16. Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.CVE-2016-0857Advantech · 28% likely

    CWE-119Advantech

17. Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerabil…CVE-2016-0005Microsoft · 28% likely

    CWE-20Microsoft

18. Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confi…CVE-2016-0486Oracle · 28% likely

    Oracle

19. Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confi…CVE-2016-0485Oracle · 28% likely

    Oracle

20. Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confi…CVE-2016-0490Oracle · 27% likely

    Oracle

21. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to execute arbitra…CVE-2016-0002Microsoft · 23% likely

    CWE-119Microsoft

22. Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format str…CVE-2015-8617Php · 23% likely

    CWE-134PHP

23. Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated u…CVE-2015-8770Roundcube · 22% likely

    CWE-22Roundcube

24. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer al…CVE-2016-0035Microsoft · 22% likely

    CWE-119Microsoft

25. Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confi…CVE-2016-0484Oracle · 22% likely

    Oracle

26. Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confi…CVE-2016-0482Oracle · 22% likely

    Oracle

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.