Likely to be exploited (10% or more)

Every one of the 71 is a mark on the map. Named now: 1 to 26, most at risk first.

1. In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section. An attacker…CVE-2021-25921Open-Emr · CVSS 5.4 · 89% likely

   CWE-79Open-Emr

2. malicious repositories can execute remote code while cloningCVE-2021-21300git · CVSS 8 · 89% likely

   CWE-59Git

3. Apache Superset stored XSS on Dashboard markdownCVE-2021-27907Apache Software Foundation · 86% likely

   CWE-79Apache

4. Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable b…CVE-2021-21628Jenkins project · 79% likely

   CWE-79Jenkins

5. XStream can cause a Denial of ServiceCVE-2021-21341x-stream · CVSS 7.5 · 78% likely

   CWE-400Xstream

6. Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This…CVE-2021-22883NodeJS · 77% likely

   CWE-400Node.js1 bounty report

7. XStream is vulnerable to an Arbitrary Code Execution attackCVE-2021-21346x-stream · CVSS 6.1 · 76% likely

   CWE-434Xstream

8. XStream is vulnerable to an Arbitrary Code Execution attackCVE-2021-21344x-stream · CVSS 5.3 · 76% likely

   CWE-434Xstream

9. This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is re…CVE-2021-27272NETGEAR · CVSS 7.1 · 75% likely

   CWE-22NETGEAR

10. This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.…CVE-2021-27275NETGEAR · CVSS 8.3 · 74% likely

    CWE-22NETGEAR

11. This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is re…CVE-2021-27276NETGEAR · CVSS 7.1 · 73% likely

    CWE-22NETGEAR

12. Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability explo…CVE-2021-21630Jenkins project · 69% likely

    CWE-79Jenkins

13. Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize…CVE-2021-21983Vmware · 69% likely

    VMware

14. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HT…CVE-2021-22992F5 · 68% likely

    CWE-120F5

15. In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A highly privileged attacker could inject a…CVE-2021-25919Open-Emr · CVSS 4.8 · 66% likely

    CWE-79Open-Emr

16. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is re…CVE-2021-27273NETGEAR · CVSS 8.8 · 66% likely

    CWE-78NETGEAR

17. NULL pointer deref in signature_algorithms processingCVE-2021-3449OpenSSL · 64% likely

    CWE-476OpenSSL

18. Remote Development Extension for Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-27083Microsoft · CVSS 7.8 · 62% likely

    Microsoft

19. Visual Studio Code Java Extension Pack Remote Code Execution VulnerabilityCVE-2021-27084Microsoft · CVSS 7.8 · 62% likely

    Microsoft

20. SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can intercept a request to the server, inject m…CVE-2021-21480SAP SE · CVSS 8.8 · 52% likely

    CWE-94SAP

21. A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local hostCVE-2021-21342x-stream · CVSS 5.3 · 50% likely

    CWE-502Xstream

22. /jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools).CVE-2021-28143Dlink · 47% likely

    CWE-78D-Link

23. A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local hostCVE-2021-21349x-stream · CVSS 6.1 · 47% likely

    CWE-502Xstream

24. XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rightsCVE-2021-21343x-stream · CVSS 5.3 · 47% likely

    CWE-73Xstream

25. rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command parameter of an API request. NOTE: thi…CVE-2021-27886Docker Dashboard Project · 46% likely

    CWE-78

26. A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request…CVE-2021-25833Onlyoffice · 44% likely

    CWE-22Onlyoffice

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.