Likely to be exploited (10% or more)

Every one of the 78 is a mark on the map. Named now: 1 to 26, most at risk first.

1. phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, whic…CVE-2016-5734Phpmyadmin · 81% likely

   CWE-94Phpmyadmin

2. ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of s…CVE-2016-2775Isc · 63% likely

   CWE-20Isc

3. The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windo…CVE-2016-3251Microsoft · 58% likely

   CWE-200Microsoft

4. The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY envi…CVE-2016-5387Apache · 56% likely

   Apache

5. Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the prese…CVE-2016-5388Apache · 51% likely

   CWE-284Apache

6. PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in…CVE-2016-5385Php · 50% likely

   CWE-601PHP

7. Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code via (1) the NetworkName proper…CVE-2016-1606Microfocus · 46% likely

   CWE-119Micro Focus

8. ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix…CVE-2016-4957Ntp · 45% likely

   CWE-476Ntp

9. The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles page-fault system calls, which allows local users to…CVE-2016-3272Microsoft · 43% likely

   CWE-200Microsoft

10. ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large A…CVE-2016-6170Isc · 41% likely

    CWE-20Isc

11. The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and…CVE-2016-3092Apache · CVSS 7.5 · 37% likely

    CWE-20Apache

12. Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to obtain sensitive information…CVE-2016-4232Adobe · 36% likely

    CWE-401Adobe

13. The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other products, allow remote…CVE-2016-3259Microsoft · 35% likely

    CWE-119Microsoft

14. The Print Spooler service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Wind…CVE-2016-3238Microsoft · 34% likely

    CWE-254Microsoft

15. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers…CVE-2016-4228Adobe · 33% likely

    CWE-416Adobe

16. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers…CVE-2016-4226Adobe · 33% likely

    CWE-416Adobe

17. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers…CVE-2016-4231Adobe · 33% likely

    CWE-416Adobe

18. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers…CVE-2016-4227Adobe · 33% likely

    CWE-416Adobe

19. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers…CVE-2016-4229Adobe · 32% likely

    CWE-416Adobe

20. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers…CVE-2016-4230Adobe · 32% likely

    CWE-416Adobe

21. Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosu…CVE-2016-3277Microsoft · 32% likely

    CWE-200Microsoft

22. Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and…CVE-2016-4203Adobe · 28% likely

    CWE-119Adobe

23. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word View…CVE-2016-3282Microsoft · 26% likely

    CWE-119Microsoft

24. ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS…CVE-2016-1182Apache · 26% likely

    CWE-20Apache

25. The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or po…CVE-2016-3955Linux · 25% likely

    CWE-119Linux

26. Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conju…CVE-2016-3255Microsoft · 25% likely

    CWE-200Microsoft

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.