Possible (1 to 10%)

Every one of the 376 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Cisco WebEx Meetings Player T29.10, when WRF file support is enabled, allows remote attackers to execute arbitrary code via a crafted file, aka Bug ID CSCva09375.CVE-2016-1464Cisco · 10.0% likely

   CWE-20Cisco

2. CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to i…CVE-2016-5699Python · 9.9% likely

   CWE-113Python2 bounty reports

3. Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.CVE-2016-6802Apache · 9.7% likely

   CWE-284Apache

4. Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitra…CVE-2016-6354Westes · 9.1% likely

   CWE-119

5. ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, which allows remote MySQL servers to cau…CVE-2016-7412Php · 8.8% likely

   CWE-119PHP1 bounty report

6. ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have u…CVE-2016-7132Php · 8.8% likely

   CWE-476PHP

7. ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have u…CVE-2016-7131Php · 8.8% likely

   CWE-476PHP

8. The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to ca…CVE-2016-7126Php · 8.8% likely

   CWE-787PHP

9. Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous be…CVE-2016-6938Adobe · 8.7% likely

   CWE-416Adobe

10. xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in…CVE-2016-4658Apple · 8.6% likely

    CWE-119Apple

11. LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character enc…CVE-2016-3861Google · 8.3% likely

    CWE-119Google

12. Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-i…CVE-2016-3379Microsoft · 8.2% likely

    CWE-79Microsoft

13. The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which all…CVE-2016-7128Php · 7.8% likely

    CWE-200PHP1 bounty report

14. Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions…CVE-2016-7098Gnu · 7.5% likely

    CWE-362GNU

15. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers…CVE-2016-6931Adobe · 7.4% likely

    CWE-416Adobe

16. Integer overflow in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute a…CVE-2016-4287Adobe · 7.3% likely

    CWE-190Adobe

17. Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds…CVE-2016-7163Uclouvain · 7.1% likely

    CWE-190Uclouvain1 bounty report

18. Microsoft Internet Explorer 10 and 11 mishandles integrity settings and zone settings, which allows remote attackers to bypass a sandbox protection mechanism via a crafted web sit…CVE-2016-3292Microsoft · 7.1% likely

    CWE-20Microsoft

19. The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code…CVE-2016-4303Es · 7.0% likely

    CWE-120Es

20. The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 mi…CVE-2016-4978Apache · 6.9% likely

    CWE-502Apache

21. ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attacker…CVE-2016-7417Php · 6.8% likely

    CWE-20PHP

22. The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, which allows remote attacke…CVE-2016-7414Php · 6.8% likely

    CWE-119PHP

23. The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possi…CVE-2016-7129Php · 6.8% likely

    CWE-20PHP

24. The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial o…CVE-2016-7127Php · 6.8% likely

    CWE-787PHP

25. Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact vi…CVE-2016-5017Apache · 6.8% likely

    CWE-119Apache

26. idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.CVE-2015-8948Gnu · 6.8% likely

    CWE-125GNU

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.