Exploited in the wild

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line ar…CVE-2021-3156Sudo · CVSS 7.8 · 100% likely

   CWE-193Sudo Project

2. Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code ExecutionCVE-2021-3129Laravel · CVSS 9.8 · 100% likely

   Laravel1 bounty report

3. Apache Flink - Local File InclusionCVE-2020-17519Apache Software Foundation · CVSS 9.1 · 98% likely

   CWE-552Apache

4. Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.CVE-2020-36193PEAR · CVSS 7.5 · 71% likely

   CWE-59Pear

5. An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote…CVE-2020-29557D-Link · CVSS 9.8 · 56% likely

   CWE-119D-Link

6. Microsoft Defender Remote Code Execution VulnerabilityCVE-2021-1647Microsoft · CVSS 7.8 · 40% likely

   Microsoft

7. Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.CVE-2021-3199ONLYOFFICE · CVSS 9.8 · 30% likelycovered by CyberSIXT

   CWE-22OnlyofficeFlax Typhoon5 articles

8. Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.CVE-2020-6572Google · CVSS 8.8 · 11% likely

   CWE-416Google

9. Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2020-16013Google · CVSS 8.8 · 2.8% likely

   CWE-787Google

10. Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape…CVE-2020-16017Google · CVSS 9.6 · 2.7% likely

    CWE-416Google

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.