Possible (1 to 10%)

Every one of the 473 is a mark on the map. Named now: 1 to 26, most at risk first.

1. The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authentica…CVE-2016-0755Haxx · 9.1% likely

   CWE-287Haxx

2. Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via…CVE-2016-0868Rockwellautomation · 8.7% likely

   CWE-119Rockwell Automation

3. An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager before 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 bef…CVE-2015-6435Cisco · 8.7% likely

   CWE-78Cisco

4. Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown v…CVE-2015-6015Oracle · 8.4% likely

   Oracle

5. Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown v…CVE-2015-6014Oracle · 8.4% likely

   Oracle

6. Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown v…CVE-2015-6013Oracle · 8.4% likely

   Oracle

7. Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and…CVE-2016-0936Adobe · 7.9% likely

   CWE-119Adobe

8. buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon ex…CVE-2015-8705Isc · 7.9% likely

   CWE-20Isc

9. The gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensiti…CVE-2016-1903Php · 7.8% likely

   CWE-119PHP

10. The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?…CVE-2016-1283Pcre · 7.8% likely

    CWE-119Pcre

11. Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) o…CVE-2015-7512Qemu · 7.7% likely

    CWE-120Qemu

12. Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted…CVE-2016-0031Microsoft · 7.6% likely

    CWE-79Microsoft

13. Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows r…CVE-2016-0032Microsoft · 7.6% likely

    CWE-79Microsoft

14. Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject a…CVE-2016-0030Microsoft · 7.6% likely

    CWE-79Microsoft

15. Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted…CVE-2016-0029Microsoft · 7.6% likely

    CWE-79Microsoft

16. Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflo…CVE-2016-0859Advantech · 7.6% likely

    CWE-189Advantech

17. Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remo…CVE-2016-0505Oracle · 7.5% likely

    Oracle

18. Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and…CVE-2016-0939Adobe · 7.4% likely

    CWE-119Adobe

19. Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confid…CVE-2016-0494Oracle · 7.2% likely

    Oracle

20. Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and…CVE-2016-0943Adobe · 7.1% likely

    CWE-264Adobe

21. Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors invo…CVE-2015-6831Php · 7.1% likely

    CWE-416PHP1 bounty report

22. The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BE…CVE-2016-1494Python · 7.0% likely

    CWE-20Python

23. Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous befor…CVE-2016-0935Adobe · 7.0% likely

    Adobe

24. The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application that leverages Q…CVE-2015-6639Google · 7.0% likely

    CWE-264Google

25. Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-si…CVE-2015-6117Microsoft · 6.9% likely

    CWE-79Microsoft

26. Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability vi…CVE-2016-0451Oracle · 6.8% likely

    Oracle

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.