Possible (1 to 10%)

Every one of the 308 is a mark on the map. Named now: 1 to 26, most at risk first.

1. The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or exe…CVE-2016-23357-Zip · 9.8% likely

   CWE-1197-Zip

2. The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via v…CVE-2016-4432Apache · 8.9% likely

   CWE-287Apache

3. web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 throu…CVE-2016-4360Hp · 8.6% likely

   HP

4. The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecti…CVE-2016-0749Spice Project · 8.5% likely

   CWE-119Spice Project

5. Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block…CVE-2016-3093Apache · 8.4% likely

   CWE-20Apache

6. PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker ter…CVE-2016-3094Apache · 7.8% likely

   CWE-287Apache

7. hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to execute arbitrary code via shell metacharac…CVE-2016-5840Trend Micro · 7.8% likely

   CWE-20Trend Micro

8. EMC NetWorker 8.2.1.x and 8.2.2.x before 8.2.2.6 and 9.x before 9.0.0.6 mishandles authentication, which allows remote attackers to execute arbitrary commands by leveraging access…CVE-2016-0916Emc · 7.7% likely

   CWE-287Emc

9. HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3,…CVE-2016-4361Hp · 7.6% likely

   HP

10. The Universal Discovery component in HPE Universal CMDB 10.0, 10.01, 10.10, 10.11, 10.20, and 10.21 allows remote attackers to obtain sensitive information via unspecified vectors.CVE-2016-4367Hp · 7.5% likely

    CWE-200HP

11. Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denia…CVE-2016-3075Gnu · 7.3% likely

    CWE-119GNU

12. Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.CVE-2016-4448Xmlsoft · 7.0% likely

    CWE-134Xmlsoft

13. The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafte…CVE-2016-5300Libexpat Project · 6.5% likely

    CWE-399Libexpat Project

14. Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cau…CVE-2016-4163Adobe · 6.3% likely

    CWE-119Adobe

15. Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cau…CVE-2016-4162Adobe · 6.3% likely

    CWE-119Adobe

16. Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cau…CVE-2016-4161Adobe · 6.3% likely

    CWE-119Adobe

17. Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cau…CVE-2016-4160Adobe · 6.3% likely

    CWE-119Adobe

18. Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cau…CVE-2016-4120Adobe · 6.3% likely

    CWE-119Adobe

19. atmfd.dll in the Adobe Type Manager Font Driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Wi…CVE-2016-3220Microsoft · 6.3% likely

    CWE-264Microsoft

20. The kernel-mode driver in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."CVE-2016-3219Microsoft · 6.1% likely

    CWE-264Microsoft

21. The Virtual PCI (VPCI) virtual service provider in Microsoft Windows Server 2012 Gold and R2 allows local users to obtain sensitive information from uninitialized memory locations…CVE-2016-3232Microsoft · 6.0% likely

    CWE-200Microsoft

22. The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Window…CVE-2016-3221Microsoft · 5.9% likely

    CWE-264Microsoft

23. Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of servi…CVE-2016-3706Gnu · 5.9% likely

    CWE-20GNU

24. The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40),…CVE-2016-0376Ibm · 5.7% likely

    IBM

25. The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitiv…CVE-2016-5244Linux · 5.5% likely

    CWE-200Linux

26. Adobe DNG Software Development Kit (SDK) before 1.4 2016 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.CVE-2016-4167Adobe · 5.4% likely

    CWE-119Adobe

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.