Possible (1 to 10%)

Every one of the 251 is a mark on the map. Named now: 1 to 26, most at risk first.

1. General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive cleartext account information…CVE-2016-0862Ge · 9.9% likely

   CWE-200Ge

2. actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1…CVE-2016-0751Rubyonrails · 9.7% likely

   CWE-399Rubyonrails

3. Microsoft Internet Explorer 9 through 11 and Microsoft Edge misparse HTTP responses, which allows remote attackers to spoof web sites via a crafted URL, aka "Microsoft Browser Spo…CVE-2016-0077Microsoft · 9.7% likely

   CWE-19Microsoft

4. The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitr…CVE-2015-5351Apache · 9.7% likely

   CWE-352Apache

5. http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a den…CVE-2016-2571Squid-Cache · 9.3% likely

   CWE-20Squid-Cache

6. The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference…CVE-2015-8787Linux · 9.2% likely

   CWE-476Linux

7. The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a de…CVE-2016-2570Squid-Cache · 9.0% likely

   CWE-20Squid-Cache

8. Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or p…CVE-2016-0746F5 · 8.9% likely

   CWE-416F5

9. The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process res…CVE-2016-0747F5 · 8.7% likely

   CWE-400F5

10. Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check,…CVE-2016-1522Mozilla · 8.3% likely

    CWE-119Mozilla

11. Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allow…CVE-2016-0753Rubyonrails · 7.2% likely

    Rubyonrails

12. The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an…CVE-2015-5344Apache · 7.1% likely

    CWE-19Apache

13. PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 allows remote attackers to cause a denial of service (infinite loop…CVE-2016-0773Postgresql · 6.9% likely

    CWE-119Postgresql

14. actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of se…CVE-2015-7581Rubyonrails · 6.7% likely

    CWE-399Rubyonrails

15. The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Ja…CVE-2016-2397Sonicwall · 6.4% likely

    CWE-77SonicWall

16. Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to cause a denial of service (STOP mode transition) via crafted packets on TCP port 102.CVE-2016-2200Siemens · 6.4% likely

    CWE-20Siemens

17. Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/ca…CVE-2016-0706Apache · 6.1% likely

    CWE-200Apache

18. Cross-site scripting (XSS) vulnerability in SharePoint Server in Microsoft SharePoint Foundation 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a craf…CVE-2016-0039Microsoft · 6.0% likely

    CWE-79Microsoft

19. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.…CVE-2016-0983Adobe · 5.9% likely

    CWE-416Adobe1 bounty report

20. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.…CVE-2016-0982Adobe · 5.9% likely

    Adobe1 bounty report

21. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandl…CVE-2016-0042Microsoft · 5.5% likely

    Microsoft

22. Use-after-free vulnerability in the instanceof function in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on…CVE-2016-0975Adobe · 5.5% likely

    CWE-416Adobe

23. Use-after-free vulnerability in the URLRequest object implementation in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.…CVE-2016-0973Adobe · 5.5% likely

    CWE-416Adobe

24. The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.CVE-2016-2037Gnu · 5.5% likely

    CWE-119GNU

25. chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when…CVE-2016-2316Digium · 5.0% likely

    CWE-191Digium

26. Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3 allow remote authe…CVE-2016-2232Digium · 4.9% likely

    Digium

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.