Likely to be exploited (10% or more)

Every one of the 77 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigur…CVE-2017-9798Apache Software Foundation · 95% likely

   CWE-416Apache1 bounty report

2. The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protectio…CVE-2017-14143Kaltura · 77% likely

   CWE-798Kaltura

3. The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter.CVE-2015-8249Manageengine · 74% likely

   CWE-434Zoho (ManageEngine)

4. Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engin…CVE-2017-8740Microsoft Corporation · 72% likely

   CWE-119Microsoft

5. Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engin…CVE-2017-8729Microsoft Corporation · 72% likely

   CWE-119Microsoft

6. CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object inject…CVE-2014-8684Codeigniter · 72% likely

   CWE-310Codeigniter

7. Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way th…CVE-2017-8755Microsoft Corporation · 71% likely

   CWE-119Microsoft

8. When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the Vi…CVE-2017-12616Apache Software Foundation · 70% likely

   CWE-200Apache

9. An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory settings by simply bro…CVE-2017-14147Fiberhome · 66% likely

   CWE-287Fiberhome

10. Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the…CVE-2017-11764Microsoft Corporation · 64% likely

    CWE-119Microsoft

11. Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the…CVE-2017-8734Microsoft Corporation · 53% likely

    CWE-119Microsoft

12. Microsoft Edge in Microsoft Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft…CVE-2017-8731Microsoft · 52% likely

    CWE-119Microsoft

13. backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR arc…CVE-2017-1000083Gnome · 51% likely

    Gnome

14. Microsoft Edge in Microsoft Windows 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in me…CVE-2017-8751Microsoft Corporation · 50% likely

    CWE-119Microsoft

15. SQL Injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrary code on vulnerable installations.CVE-2017-14078Trend Micro · 50% likely

    CWE-89Trend Micro

16. In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk t…CVE-2017-14098Digium · 50% likely

    CWE-20Digium

17. Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 170…CVE-2017-8682Microsoft Corporation · 50% likely

    CWE-20Microsoft

18. CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP i…CVE-2014-8686Codeigniter · 37% likely

    CWE-310Codeigniter

19. PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute…CVE-2015-8351Gwolle Guestbook Project · 37% likely

    CWE-94

20. Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, wh…CVE-2017-14867Git-Scm · 36% likely

    CWE-78Git-Scm

21. The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image pointers after certain error conditions, which allows remote a…CVE-2017-14103Graphicsmagick · 30% likely

    CWE-416Graphicsmagick

22. IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it could cause the Notes client to hang and have to be restarted.…CVE-2017-1129IBM · 30% likely

    IBM

23. IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it would open up many file select dialog boxes which would cause t…CVE-2017-1130IBM · 29% likely

    IBM

24. DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then…CVE-2017-14706Denyall · 28% likely

    CWE-287

25. On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password cha…CVE-2017-14335Hbgk · 28% likely

    CWE-20

26. The Windows Server DHCP service in Windows Server 2012 Gold and R2, and Windows Server 2016 allows an attacker to either run arbitrary code on the DHCP failover server or cause th…CVE-2017-8686Microsoft · 27% likely

    CWE-119Microsoft

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.