Likely to be exploited (10% or more)

Every one of the 59 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors…CVE-2016-3087Apache · 82% likely

   CWE-20Apache

2. The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gol…CVE-2016-3236Microsoft · 76% likely

   CWE-19Microsoft

3. The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enu…CVE-2016-1542Bmc · 75% likely

   CWE-20Bmc

4. The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and…CVE-2016-1543Bmc · 72% likely

   CWE-284Bmc

5. Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.CVE-2015-7611Apache · 69% likely

   CWE-78Apache

6. The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gol…CVE-2016-3213Microsoft · 67% likely

   CWE-264Microsoft

7. Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vul…CVE-2016-3222Microsoft · 57% likely

   CWE-119Microsoft

8. The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec End…CVE-2016-2211Symantec · 53% likely

   CWE-119Symantec

9. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet E…CVE-2016-0199Microsoft · 51% likely

   CWE-119Microsoft

10. The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filena…CVE-2016-5118Graphicsmagick · 50% likely

    Graphicsmagick

11. GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.CVE-2016-4971Gnu · 46% likely

    GNU

12. OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and a…CVE-2016-2177Openssl · 45% likely

    CWE-190OpenSSL1 bounty report

13. The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windo…CVE-2016-3225Microsoft · 43% likely

    CWE-264Microsoft

14. HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have un…CVE-2016-5360Haproxy · 43% likely

    CWE-119Haproxy

15. Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 1511, and Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafte…CVE-2016-3215Microsoft · 34% likely

    CWE-200Microsoft

16. Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to execute arbitrary code via a crafted PDF document, a…CVE-2016-3203Microsoft · 33% likely

    CWE-20Microsoft

17. Microsoft Edge allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted document, aka "Microsoft Edge Security Feature Bypass."CVE-2016-3198Microsoft · 32% likely

    CWE-254Microsoft

18. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet E…CVE-2016-3211Microsoft · 32% likely

    CWE-119Microsoft

19. Directory traversal vulnerability in the WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to read arbitrary files via a cr…CVE-2016-4532Trihedral · 28% likely

    CWE-22Trihedral

20. The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scri…CVE-2016-3199Microsoft · 27% likely

    CWE-119Microsoft

21. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Servic…CVE-2016-3234Microsoft · 26% likely

    CWE-200Microsoft

22. Use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests, aka "…CVE-2016-3227Microsoft · 25% likely

    Microsoft

23. Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unkno…CVE-2016-4138Adobe · 25% likely

    Adobe

24. GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1…CVE-2016-3216Microsoft · 25% likely

    CWE-200Microsoft

25. Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or…CVE-2016-5108Videolan · 25% likely

    CWE-119Videolan

26. Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.…CVE-2016-3645Symantec · 25% likely

    CWE-189Symantec

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.