Likely to be exploited (10% or more)

Every one of the 83 is a mark on the map. Named now: 1 to 26, most at risk first.

1. OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has b…CVE-2018-15473Openbsd · CVSS 5.9 · 99% likely

   CWE-362Openbsd

2. A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the 'recentVersion'…CVE-2018-14417Softnas · 89% likely

   CWE-78

3. The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page…CVE-2018-15877Plainview Activity Monitor Project · 77% likely

   CWE-78

4. An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access, an attacker can inte…CVE-2018-12710Dlink · 77% likely

   CWE-319D-Link

5. Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of…CVE-2018-5390Linux · 72% likely

   CWE-400Linux

6. It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privil…CVE-2018-10931The Cobbler Project · CVSS 9.8 · 68% likely

   CWE-749Cobbler Project

7. A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability…CVE-2018-8355Microsoft · 68% likely

   CWE-787Microsoft

8. A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka "GDI+ Remote Code Execution Vulnerabili…CVE-2018-8397Microsoft · 68% likely

   Microsoft

9. A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerabi…CVE-2018-8353Microsoft · 67% likely

   CWE-416Microsoft

10. From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the…CVE-2018-11770Apache Software Foundation · 66% likely

    CWE-287Apache

11. A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruptio…CVE-2018-8384Microsoft · 64% likely

    CWE-843Microsoft

12. Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of a…CVE-2018-15727Grafana · 63% likely

    CWE-287Grafana

13. OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/…CVE-2018-15153Open-Emr · 61% likely

    CWE-78Open-Emr

14. An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 throu…CVE-2018-14773Sensiolabs · 58% likely

    Sensiolabs

15. Citrix XenServer 7.1 and newer allows Directory Traversal.CVE-2018-14007Citrix · 47% likely

    CWE-22Citrix (NetScaler)

16. D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.CVE-2018-15839Dlink · 45% likely

    CWE-119D-Link

17. An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.5096. A specially crafted PDF document can trigger a p…CVE-2018-3924Foxit · CVSS 8.8 · 44% likely

    CWE-416Foxit

18. A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the c…CVE-2018-14716Nystudio107 · 33% likely

    CWE-94Nystudio107

19. Geutebrueck re_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information including usernames and hashes via a direct request for /statistics…CVE-2018-15534Geutebrueck · 32% likely

    CWE-200Geutebrueck

20. Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.CVE-2018-12827Adobe · 32% likely

    CWE-125Adobe

21. In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attac…CVE-2018-13415Plex · 31% likely

    CWE-611Plex

22. A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system, aka "Microsoft SQL Server Remote Code Execution Vu…CVE-2018-8273Microsoft · 31% likely

    CWE-787Microsoft

23. A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerabi…CVE-2018-8389Microsoft · 30% likely

    CWE-787Microsoft

24. Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not properly restrict access t…CVE-2018-16158Eaton · 30% likely

    CWE-798Eaton

25. A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruptio…CVE-2018-8266Microsoft · 29% likely

    CWE-787Microsoft

26. Pimcore before 5.3.0 allows SQL Injection via the REST web service API.CVE-2018-14058Pimcore · 29% likely

    CWE-89Pimcore

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.