Possible (1 to 10%)

Every one of the 442 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.CVE-2016-4433Apache · 9.8% likely

   CWE-20Apache

2. Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.CVE-2016-4431Apache · 9.8% likely

   CWE-20Apache

3. Unspecified vulnerability in the Oracle Knowledge Management component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote administrators t…CVE-2016-3542Oracle · 9.7% likely

   Oracle

4. goform/Docsis_system on Cisco EPC3928 devices allows remote attackers to cause a denial of service (device crash) via a long LanguageSelect parameter, related to a "Gateway HTTP C…CVE-2016-1336Cisco · 9.3% likely

   CWE-20Cisco

5. goform/WClientMACList on Cisco EPC3928 devices allows remote attackers to cause a denial of service (device crash) via a long h_sortWireless parameter, related to a "Gateway Clien…CVE-2016-1328Cisco · 9.3% likely

   CWE-20Cisco

6. Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.3.0 and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, a…CVE-2016-3499Oracle · 8.9% likely

   Oracle

7. ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoo…CVE-2016-4955Ntp · 8.8% likely

   CWE-362Ntp

8. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers…CVE-2016-4222Adobe · 8.5% likely

   CWE-416Adobe

9. Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing Vulnerabi…CVE-2016-3274Microsoft · 8.3% likely

   CWE-284Microsoft

10. Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by le…CVE-2016-4531Rockwellautomation · 8.2% likely

    CWE-285Rockwell Automation

11. Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing Vulnerability."CVE-2016-3276Microsoft · 8.2% likely

    CWE-284Microsoft

12. Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests t…CVE-2016-4469Apache · 7.9% likely

    CWE-352Apache

13. Heap-based buffer overflow in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous befo…CVE-2016-4209Adobe · 7.9% likely

    CWE-119Adobe

14. Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and av…CVE-2016-3607Oracle · 7.5% likely

    Oracle

15. ImageIO in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted xStride and yStride values in a…CVE-2016-4629Apple · 7.4% likely

    CWE-119Apple

16. Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code by lev…CVE-2016-4225Adobe · 7.4% likely

    CWE-843Adobe

17. Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code by lev…CVE-2016-4224Adobe · 7.4% likely

    CWE-843Adobe

18. Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code by lev…CVE-2016-4223Adobe · 7.4% likely

    CWE-843Adobe

19. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers…CVE-2016-4248Adobe · 7.3% likely

    CWE-416Adobe1 bounty report

20. Heap-based buffer overflow in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to…CVE-2016-4249Adobe · 7.1% likely

    CWE-787Adobe

21. Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a d…CVE-2014-9862Apple · 6.8% likely

    CWE-190Apple

22. Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Li…CVE-2016-3598Oracle · 6.7% likely

    Oracle

23. Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPL…CVE-2016-2074Openvswitch · 6.4% likely

    CWE-119Openvswitch

24. SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2016-4522Rockwellautomation · 6.3% likely

    CWE-89Rockwell Automation

25. Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9,…CVE-2016-6296Php · 6.3% likely

    CWE-119PHP

26. Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticat…CVE-2016-4974Apache · 6.2% likely

    CWE-20Apache

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.