Check available, not yet exploited

Every one of the 36 is a mark on the map. Named now: 1 to 26, most at risk first.

1. VMware View Planner <4.6 SP1- Remote Code ExecutionCVE-2021-21978Vmware · 99% likely

   CWE-862VMware

2. Apache OFBiz <17.12.06 - Arbitrary Code ExecutionCVE-2021-26295Apache Software Foundation · 98% likely

   CWE-502Apache

3. WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File UploadCVE-2021-24145Webnus · 88% likely

   CWE-434Webnus

4. Grafana Unauthenticated Snapshot CreationCVE-2021-27358Grafana · 83% likely

   Grafana

5. XStream <1.4.16 - Remote Code ExecutionCVE-2021-21351x-stream · CVSS 5.4 · 82% likely

   CWE-434Xstream

6. Jellyfin <10.7.0 - Local File InclusionCVE-2021-21402jellyfin · CVSS 7.7 · 79% likely

   CWE-22Jellyfin

7. LDAP Injection In OpenAMCVE-2021-29156Forgerock · 77% likely

   CWE-74Forgerock2 bounty reports

8. Mongo-Express - Remote Code ExecutionCVE-2020-24391Mongo-Express Project · 75% likely
9. XStream < 1.4.16 - Remote Code ExecutionCVE-2021-21345x-stream · CVSS 5.8 · 72% likely

   CWE-94Xstream

10. SonLogger - Arbitrary File UploadCVE-2021-27964Sfcyazilim · 48% likely

    CWE-434

11. WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information DisclosureCVE-2021-24146Webnus · 31% likely

    CWE-284Webnus

12. TOTVS Fluig <= 1.7.0 - Arbitrary File ReadCVE-2020-29134Totvs · 28% likely

    CWE-22TOTVS

13. LumisXP <10.0.0 - Blind XML External Entity AttackCVE-2021-27931Lumis · 18% likely

    CWE-611

14. KeyCloak - Information ExposureCVE-2020-27838Redhat · 18% likely

    CWE-287Red Hat

15. AfterLogic Aurora and WebMail Pro < 7.7.9 - Information DisclosureCVE-2021-26294Afterlogic · 17% likely

    CWE-22Afterlogic

16. Aruba Instant Access Point (IAP) - Cross-Site ScriptingCVE-2021-25161Arubanetworks · 16% likely

    CWE-79Arubanetworks

17. WP Hotel Booking < 1.10.4 - PHP Object InjectionCVE-2020-29047Thimpress · 16% likely

    CWE-502ThimPress

18. BuddyPress REST API <7.2.1 - Privilege Escalation/Remote Code ExecutionCVE-2021-21389buddypress · CVSS 8.1 · 15% likely

    CWE-863BuddyPress1 bounty report

19. Gridx 1.3 - Remote Code ExecutionCVE-2020-19625Gridx Project · 13% likely
20. Doctor Appointment System 1.0 - SQL InjectionCVE-2021-27314Doctor Appointment System Project · 12% likely

    CWE-89Doctor Appointment System Project

21. Doctor Appointment System 1.0 - SQL InjectionCVE-2021-27320Doctor Appointment System Project · 9.3% likely

    CWE-89Doctor Appointment System Project

22. npm ansi_up v4 - Cross-Site ScriptingCVE-2021-3377Ansi Up Project · 8.0% likely

    CWE-79

23. Doctor Appointment System 1.0 - SQL InjectionCVE-2021-27319Doctor Appointment System Project · 7.8% likely

    CWE-89Doctor Appointment System Project

24. Doctor Appointment System 1.0 - SQL InjectionCVE-2021-27316Doctor Appointment System Project · 7.8% likely

    CWE-89Doctor Appointment System Project

25. Doctor Appointment System 1.0 - SQL InjectionCVE-2021-27315Doctor Appointment System Project · 7.8% likely

    CWE-89Doctor Appointment System Project

26. FUDForum 3.1.0 - Cross-Site ScriptingCVE-2021-27519Fudforum · 7.6% likely

    CWE-79Fudforum

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.