Skip to content

October 2016 · Band 2

Check available, not yet exploited

29 CVEs

Each square is a CVE with a public nuclei template and no known exploitation yet. The named ones are the most likely to be exploited.

check available
29

Every one of the 29 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Eclipse Jetty <9.2.9.v20150224 - Sensitive Information LeakageCVE-2015-2080Eclipse · 75% likely

    CWE-200Eclipse Foundation

  2. WordPress MyPixs <=0.3 - Local File InclusionCVE-2015-1000012Mypixs Project · 9.3% likely

    CWE-200

  3. WordPress Candidate Application Form <= 1.3 - Local File InclusionCVE-2015-1000005Candidate-Application-Form Project · 8.6% likely

    CWE-22

  4. WordPress Simple Image Manipulator < 1.0 - Local File InclusionCVE-2015-1000010Simple-Image-Manipulator Project · 6.9% likely

    CWE-284

  5. WordPress HDW Video Gallery <=1.2 - Cross-Site ScriptingCVE-2016-1000135Hdw-Tube Project · 4.7% likely

    CWE-79

  6. WordPress HDW Video Gallery <=1.2 - Cross-Site ScriptingCVE-2016-1000134Hdw-Tube Project · 4.7% likely

    CWE-79

  7. WordPress e-search <=1.0 - Cross-Site ScriptingCVE-2016-1000131E-Search Project · 4.7% likely

    CWE-79

  8. WordPress WPSOLR <=8.6 - Cross-Site ScriptingCVE-2016-1000155Wpsolr · 4.5% likely

    CWE-79

  9. WordPress Tidio Gallery <=1.1 - Cross-Site ScriptingCVE-2016-1000153Tidio-Gallery Project · 4.5% likely

    CWE-79

  10. WordPress MW Font Changer <=4.2.5 - Cross-Site ScriptingCVE-2016-1000142Parsi-Font Project · 4.4% likely

    CWE-79

  11. WordPress Hero Maps Pro 2.1.0 - Cross-Site ScriptingCVE-2016-1000137Hero-Maps-Pro Project · 4.4% likely

    CWE-79

  12. WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site ScriptingCVE-2016-1000132Cminds · 4.4% likely

    CWE-79Cminds

  13. WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site ScriptingCVE-2016-1000139Infusionsoft Project · 4.2% likely

    CWE-79

  14. WordPress anti-plagiarism <=3.60 - Cross-Site ScriptingCVE-2016-1000128Anti-Plagiarism Project · 4.2% likely

    CWE-79

  15. WordPress Tidio-form <=1.0 - Cross-Site ScriptingCVE-2016-1000152Tidio-Form Project · 4.2% likely

    CWE-79

  16. WordPress Simpel Reserveren <=3.5.2 - Cross-Site ScriptingCVE-2016-1000149Simpel-Reserveren Project · 4.0% likely

    CWE-79

  17. WordPress AJAX Random Post <=2.00 - Cross-Site ScriptingCVE-2016-1000127Ajax-Random-Post Project · 3.7% likely

    CWE-79

  18. WordPress Admin Font Editor <=1.8 - Cross-Site ScriptingCVE-2016-1000126Admin-Font-Editor Project · 3.7% likely

    CWE-79

  19. WordPress Photoxhibit 2.1.8 - Cross-Site ScriptingCVE-2016-1000143Photoxhibit Project · 3.6% likely

    CWE-79

  20. WordPress Pondol Form to Mail <=1.1 - Cross-Site ScriptingCVE-2016-1000146Pondol-Formmail Project · 3.5% likely

    CWE-79

  21. WordPress Page Layout builder v1.9.3 - Cross-Site ScriptingCVE-2016-1000141Page-Layout-Builder Project · 3.5% likely

    CWE-79

  22. WordPress WHIZZ <=1.0.7 - Cross-Site ScriptingCVE-2016-1000154Browserweb · 3.4% likely

    CWE-79

  23. WordPress New Year Firework <=1.1.9 - Cross-Site ScriptingCVE-2016-1000140New-Year-Firework Project · 3.4% likely

    CWE-79

  24. WordPress Admin Font Editor <=1.8 - Cross-Site ScriptingCVE-2016-1000138Indexisto Project · 3.4% likely

    CWE-79

  25. WordPress heat-trackr 1.0 - Cross-Site ScriptingCVE-2016-1000136Heat-Trackr Project · 3.4% likely

    CWE-79

  26. WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site ScriptingCVE-2016-1000133Designsandcode · 3.4% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.