Likely to be exploited (10% or more)

Every one of the 47 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2020-16040Google · 100% likelycovered by CyberSIXT

   CWE-190Google

2. A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. Th…CVE-2020-25687Thekelleys · 89% likely

   CWE-122Thekelleys

3. A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A…CVE-2020-25683Thekelleys · 89% likely

   CWE-122Thekelleys

4. An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.CVE-2020-36228Openldap · 85% likely

   CWE-191Openldap

5. An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c…CVE-2020-36221Openldap · 85% likely

   CWE-191Openldap

6. A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the ne…CVE-2020-25681Thekelleys · 84% likely

   CWE-122Thekelleys

7. An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authentica…CVE-2020-35578Nagios · 82% likely

   CWE-78Nagios

8. [20210102] - Core - XSS in mod_breadcrumbs aria-label attributeCVE-2021-23124Joomla! Project · 79% likely

   CWE-79Joomla

9. A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.CVE-2020-36227Openldap · 77% likely

   CWE-835Openldap

10. A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.CVE-2020-36222Openldap · 77% likely

    CWE-617Openldap

11. A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data.…CVE-2020-25682Thekelleys · 75% likely

    CWE-122Thekelleys

12. Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 1…CVE-2020-14756Oracle Corporation · CVSS 9.8 · 75% likely

    Oracle

13. Pre-Auth Unsafe Deserialization on AttachmentUploadServetCVE-2021-21242theonedev · CVSS 10 · 74% likely

    CWE-74Theonedev

14. This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5. Authentication is not required to exploit this vuln…CVE-2020-27858Arcserve · CVSS 7.5 · 74% likely

    CWE-611Arcserve

15. Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0,…CVE-2021-2109Oracle Corporation · CVSS 7.2 · 71% likely

    Oracle

16. OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.CVE-2020-19364Open-Emr · 71% likely

    CWE-434Open-Emr

17. In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specia…CVE-2020-8264Rubyonrails · 67% likely

    CWE-79Rubyonrails1 bounty report

18. IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of…CVE-2020-4888IBM · CVSS 6.3 · 62% likely

    CWE-502IBM

19. Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). Supported versions that are affected are 12.1.1-12.…CVE-2021-2114Oracle Corporation · CVSS 8.2 · 59% likely

    Oracle

20. Pre-Auth Unsafe Deserialization on KubernetesResourceCVE-2021-21243theonedev · CVSS 10 · 54% likely

    CWE-74Theonedev

21. A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticated users to execute arbitrary code as ro…CVE-2020-35576Tp-Link · 42% likely

    CWE-78TP-Link

22. KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter.CVE-2021-3317Klogserver · 41% likely

    CWE-78

23. Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/Rout…CVE-2020-35391Tenda · CVSS 9.6 · 35% likely

    CWE-425Tenda

24. Pepper+Fuchs Comtrol IO-Link Master OS Command InjectionCVE-2020-12513Pepper+Fuchs · CVSS 7.5 · 31% likely

    CWE-78

25. Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection . Using this vulnerability, an attacker can bypass the logi…CVE-2021-3278Local Services Search Engine Management System Project · 25% likely

    CWE-89

26. An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, including PHP…CVE-2020-35948Xcloner · CVSS 9.9 · 25% likely

    CWE-863Xcloner

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.