Possible (1 to 10%)

Every one of the 729 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer…CVE-2017-0898HackerOne · 9.7% likely

   CWE-134HackerOne1 bounty report

2. Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703,…CVE-2017-8695Microsoft Corporation · 9.6% likely

   CWE-200Microsoft

3. On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-F…CVE-2017-11120Broadcom · 9.1% likely

   CWE-119Broadcom

4. T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg.CVE-2017-13713Twsz · 9.1% likely

   CWE-78Twsz

5. Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windo…CVE-2017-8750Microsoft Corporation · 9.0% likely

   CWE-119Microsoft

6. Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way th…CVE-2017-8752Microsoft Corporation · 8.9% likely

   CWE-119Microsoft

7. The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using m…CVE-2017-9793Apache Software Foundation · 8.8% likely

   CWE-20Apache

8. Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the…CVE-2017-8756Microsoft Corporation · 8.7% likely

   CWE-119Microsoft

9. Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the…CVE-2017-8753Microsoft Corporation · 8.7% likely

   CWE-119Microsoft

10. Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way th…CVE-2017-8738Microsoft Corporation · 8.7% likely

    CWE-119Microsoft

11. Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the…CVE-2017-11766Microsoft Corporation · 8.6% likely

    CWE-119Microsoft

12. Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Mic…CVE-2017-8649Microsoft Corporation · 8.6% likely

    CWE-119Microsoft

13. Multiple unrestricted file upload vulnerabilities in the (1) imageSubmit and (2) proof_submit functions in Claydip Laravel Airbnb Clone 1.0 allow remote authenticated users to exe…CVE-2017-14704Claydip · 8.5% likely

    CWE-434

14. Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windo…CVE-2017-8736Microsoft Corporation · 8.4% likely

    CWE-200Microsoft

15. SQL injection vulnerability in WordPress Community Events plugin before 1.4.CVE-2015-3313Community Events Project · 8.3% likely

    CWE-89

16. ERS Data System 1.8.1.0 allows remote attackers to execute arbitrary code, related to "com.branaghgroup.ecers.update.UpdateRequest" object deserialization.CVE-2017-14702Branaghgroup · 8.3% likely

    CWE-502

17. In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare…CVE-2017-9804Apache Software Foundation · 8.2% likely

    CWE-20Apache

18. In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution…CVE-2016-6795Apache Software Foundation · 8.2% likely

    CWE-22Apache

19. During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file,…CVE-2017-12621Apache Software Foundation · 8.1% likely

    CWE-611Apache

20. The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 491…CVE-2017-14117Att · 8.0% likely

    CWE-287Att

21. All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information fr…CVE-2017-1000250Bluez · 7.8% likely

    CWE-200Bluez

22. The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) v…CVE-2017-14033Ruby-Lang · 7.7% likely

    CWE-119Ruby-Lang

23. Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.CVE-2015-5169Apache · 7.5% likely

    CWE-79Apache

24. The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task.CVE-2015-4075Helpdeskpro · 7.4% likely

    CWE-74Helpdesk Pro Project

25. Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root.CVE-2017-9328Terra-Master · 7.4% likely

    CWE-78Terra-Master

26. DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile…CVE-2017-14705Denyall · 7.4% likely

    CWE-78

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.