Exploited in the wild

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to exe…CVE-2016-3714ImageMagick · CVSS 8.4 · 97% likely

   CWE-20Imagemagick1 bounty report

2. Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.CVE-2016-4117Adobe · CVSS 7.8 · 94% likely

   AdobeAPT37

3. The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code…CVE-2016-0189Microsoft · CVSS 7.5 · 94% likely

   CWE-787Microsoft

4. The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted im…CVE-2016-3718ImageMagick · CVSS 5.5 · 76% likely

   CWE-918Imagemagick

5. The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.CVE-2016-3715ImageMagick · CVSS 5.5 · 75% likely

   CWE-552Imagemagick

6. Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka…CVE-2016-0185Microsoft · CVSS 7.8 · 70% likely

   Microsoft

7. The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary co…CVE-2010-5326SAP · CVSS 10 · 18% likely

   CWE-306SAPFIN13

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.