Possible (1 to 10%)

Every one of the 761 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2021-21157Google · 9.5% likely

   CWE-416Google

2. Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension.CVE-2021-21126Google · 9.4% likely

   CWE-20Google

3. Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers who are able…CVE-2021-21619Jenkins project · 9.4% likely

   CWE-79Jenkins

4. Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exp…CVE-2021-21622Jenkins project · 9.4% likely

   CWE-79Jenkins

5. encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact…CVE-2021-26937Gnu · 9.3% likely

   CWE-88GNU

6. Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML…CVE-2021-21125Google · 8.7% likely

   CWE-59Google

7. Magento UPWARD-php Path traversal vulnerability via UPWARD ConnectorCVE-2021-21064Adobe · CVSS 4.9 · 8.5% likely

   CWE-22Adobe

8. Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.CVE-2021-26119Smarty · 8.5% likely

   Smarty

9. Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HT…CVE-2021-21124Google · 8.5% likely

   CWE-416Google

10. Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.CVE-2021-21131Google · 8.2% likely

    CWE-59Google

11. An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of differe…CVE-2021-3148Saltstack · 8.2% likely

    CWE-77Saltstack

12. A potential security vulnerability has been identified in the HPE Moonshot Provisioning Manager v1.20. The HPE Moonshot Provisioning Manager is an application that is installed in…CVE-2021-25139Hp · 8.2% likely

    CWE-787HP

13. A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the…CVE-2020-35498Openvswitch · CVSS 7.5 · 8.0% likely

    CWE-400Openvswitch

14. Omron CX-OneCVE-2020-27261Omron · 7.9% likely

    CWE-121Omron

15. PDF Injection BlackHat TalkCVE-2020-29075Adobe · CVSS 7.1 · 7.9% likely

    CWE-20Adobe

16. xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.CVE-2021-27135Invisible-Island · 7.9% likely

    Invisible-Island

17. Adobe Photoshop Buffer Overflow Vulnerability Could Lead To Remote Code Execution VulnerabilityCVE-2021-21051Adobe · CVSS 7.8 · 7.7% likely

    CWE-120Adobe

18. In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows…CVE-2021-3281Djangoproject · 7.6% likely

    CWE-22Djangoproject1 bounty report

19. Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2021-21122Google · 7.6% likely

    CWE-416Google

20. Null pointer deref in X509_issuer_and_serial_hash()CVE-2021-23841OpenSSL · 7.5% likely

    CWE-476OpenSSL

21. Regular Expression Denial of Service (ReDoS)CVE-2020-28500Lodash · CVSS 5.3 · 7.4% likely

    Lodash

22. Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2021-21120Google · 7.4% likely

    CWE-416Google

23. Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a craf…CVE-2021-21119Google · 7.4% likely

    CWE-416Google

24. A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.CVE-2021-3355Lightcms Project · 7.2% likely

    CWE-79Lightcms Project

25. Privilege escalation in PolrCVE-2021-21276cydrobolt · CVSS 9.3 · 7.2% likely

    CWE-863

26. Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Na…CVE-2021-3273Nagios · 7.2% likely

    CWE-94Nagios

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.