Possible (1 to 10%)

Every one of the 865 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code…CVE-2021-3193Nagios · 9.9% likely

   Nagios

2. oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field)…CVE-2020-36178Tp-Link · 9.8% likely

   CWE-78TP-Link

3. Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase:…CVE-2020-8265NodeJS · 9.1% likely

   CWE-416Node.js1 bounty report

4. Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request.CVE-2020-27733Zohocorp · 8.9% likely

   CWE-89Zoho (ManageEngine)

5. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIC…CVE-2020-36188Fasterxml · 8.8% likely

   CWE-502Fasterxml

6. Kubernetes man in the middle using LoadBalancer or ExternalIPsCVE-2020-8554Kubernetes · CVSS 6.3 · 8.7% likely

   CWE-283Kubernetes1 bounty report

7. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPool…CVE-2020-36184Fasterxml · CVSS 8.8 · 8.4% likely

   CWE-502Fasterxml

8. Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control.CVE-2018-19418Foxitsoftware · 8.3% likely

   CWE-77Foxitsoftware

9. Windows Docker Information Disclosure VulnerabilityCVE-2021-1645Microsoft · CVSS 5 · 7.8% likely

   Microsoft

10. WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploi…CVE-2021-3331Winscp · 7.7% likely

    Winscp

11. The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the…CVE-2020-35488Nxlog · 7.6% likely

    CWE-502NXLog

12. A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is…CVE-2021-20190Fasterxml · CVSS 8.1 · 7.6% likely

    CWE-502Fasterxml

13. IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attac…CVE-2020-4682IBM · CVSS 8.1 · 7.6% likely

    CWE-502IBM

14. There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment within Airwave Glass before 1.3.3. Succes…CVE-2020-24639Arubanetworks · 7.5% likely

    CWE-502Arubanetworks

15. Remote code execution in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to arbitrary commands as root on the devices.CVE-2020-23160Pyres · 7.0% likely
16. Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use o…CVE-2021-3115Golang · 6.9% likely

    CWE-427Golang

17. In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or wr…CVE-2020-28374Linux · 6.6% likely

    CWE-22Linux

18. Microsoft SQL Elevation of Privilege VulnerabilityCVE-2021-1636Microsoft · CVSS 8.8 · 6.5% likely

    CWE-89Microsoft

19. DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could potentially exploit t…CVE-2020-29495Dell · CVSS 10 · 6.4% likely

    CWE-22Dell

20. XMLBeans XML Entity ExpansionCVE-2021-23926Apache Software Foundation · 6.3% likely

    CWE-776Apache

21. KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer En…CVE-2020-27267Ge · 6.0% likely

    CWE-416Ge

22. KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer En…CVE-2020-27263Ge · 6.0% likely

    CWE-122Ge

23. Apache Dubbo default deserialization protocol Hessian2 cause CRECVE-2020-11995Apache Software Foundation · 5.9% likely

    CWE-502Apache

24. Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service VulnerabilitiesCVE-2021-1167Cisco · CVSS 7.2 · 5.9% likely

    CWE-121Cisco

25. Heap buffer overflow when handling crafted font file could lead to arbitrary code executionCVE-2021-21006Adobe · CVSS 8.6 · 5.9% likely

    CWE-122Adobe

26. A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside the intended folder. T…CVE-2020-13450Thecodingmachine · 5.8% likely

    CWE-22Thecodingmachine

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.