Likely to be exploited (10% or more)

Every one of the 109 is a mark on the map. Named now: 1 to 26, most at risk first.

1. An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.CVE-2021-25282Saltstack · 93% likely

   CWE-22Saltstack

2. This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication is required to exploi…CVE-2020-27871SolarWinds · CVSS 7.2 · 91% likely

   CWE-22SolarWinds

3. Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.CVE-2020-17523Apache · 86% likely

   CWE-287Apache

4. Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript ExecutionCVE-2021-21029Adobe · CVSS 4.8 · 85% likely

   CWE-79Adobe

5. Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.CVE-2021-26120Smarty · 82% likely

   CWE-94Smarty

6. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395. Authentication is not required to exploit this vulner…CVE-2020-27868Qognify · CVSS 9.8 · 82% likely

   CWE-502

7. Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site scripting (XSS) vulnerabil…CVE-2021-21618Jenkins project · 79% likely

   CWE-79Jenkins

8. An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.1…CVE-2020-13947Apache · 79% likely

   CWE-79Apache

9. In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “qualit…CVE-2020-27223The Eclipse Foundation · CVSS 5.2 · 78% likely

   CWE-407Eclipse Foundation

10. A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacke…CVE-2020-13562Phpgacl Project · CVSS 9.6 · 78% likely

    CWE-80Phpgacl Project

11. NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueS…CVE-2021-26914Netmotionsoftware · 78% likely

    CWE-502Netmotionsoftware

12. Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers…CVE-2021-21616Jenkins project · 76% likely

    CWE-79Jenkins

13. A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacke…CVE-2020-13564Phpgacl Project · CVSS 9.6 · 76% likely

    CWE-80Phpgacl Project

14. A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacke…CVE-2020-13563Phpgacl Project · CVSS 9.6 · 76% likely

    CWE-80Phpgacl Project

15. An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options…CVE-2021-3197Saltstack · 72% likely

    CWE-74Saltstack

16. An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafte…CVE-2020-13580Softmaker · CVSS 8.8 · 71% likely

    CWE-787Softmaker

17. An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document…CVE-2020-13579Softmaker · CVSS 8.8 · 71% likely

    CWE-190Softmaker

18. In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a deni…CVE-2021-27212Openldap · 66% likely

    CWE-617Openldap

19. In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick t…CVE-2020-13548Foxitsoftware · CVSS 8 · 66% likely

    CWE-416Foxitsoftware

20. A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackCVE-2020-8625ISC · CVSS 8.1 · 65% likely

    CWE-120Isc

21. The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. To exploit the vulnerability, an authenticated attacker can s…CVE-2020-36243Open-Emr · 64% likely

    CWE-78Open-Emr

22. Windows TCP/IP Denial of Service VulnerabilityCVE-2021-24086Microsoft · CVSS 7.5 · 59% likely

    Microsoft

23. Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution.CVE-2021-26747Netis-Systems · 55% likely

    CWE-78Netis-Systems

24. Integer overflow in CipherUpdateCVE-2021-23840OpenSSL · CVSS 7.5 · 51% likely

    CWE-190OpenSSL1 bounty report

25. A flaw was found in mupdf 1.18.0. Double free of object during linearization may lead to memory corruption and other potential consequences.CVE-2021-3407Artifex · CVSS 7.8 · 50% likely

    CWE-415Artifex

26. Cross-site scripting vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to inject an arbitrary script via unspecified vectors.CVE-2021-20660Contec Co., Ltd. · 47% likely

    CWE-79Contec Co., Ltd.

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.