Possible (1 to 10%)

Every one of the 682 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Incomplete fix for CVE-2020-9484CVE-2021-25329Apache Software Foundation · 9.5% likely

   Apache

2. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems wit…CVE-2021-22990F5 · 8.8% likely

   F5

3. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running i…CVE-2021-22989F5 · 8.8% likely

   F5

4. Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.CVE-2021-28378Gitea · CVSS 3.7 · 8.8% likely

   CWE-79Gitea

5. Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scripting (XSS) vulnerabil…CVE-2021-21635Jenkins project · 8.8% likely

   CWE-79Jenkins

6. Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the ser…CVE-2021-26814Wazuh · 8.7% likely

   CWE-22Wazuh

7. A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remote attacker to write arbitrary data in…CVE-2021-3466Gnu · 8.7% likely

   CWE-120GNU

8. Cisco IOS XE Software Web UI Command Injection VulnerabilityCVE-2021-1435Cisco · CVSS 6.6 · 8.5% likely

   CWE-22Cisco

9. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Authentication is not require…CVE-2021-27274NETGEAR · CVSS 9.8 · 8.5% likely

   CWE-434NETGEAR

10. URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthServiceCVE-2021-21337zopefoundation · CVSS 5.7 · 8.4% likely

    CWE-601Zopefoundation

11. Adobe Animate heap-based overflow vulnerabilityCVE-2021-21077Adobe · CVSS 7.8 · 8.3% likely

    CWE-122Adobe

12. Windows DNS Server Denial of Service VulnerabilityCVE-2021-26896Microsoft · CVSS 7.5 · 7.8% likely

    Microsoft

13. Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-26895Microsoft · CVSS 9.8 · 7.8% likely

    Microsoft

14. Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-26894Microsoft · CVSS 9.8 · 7.8% likely

    Microsoft

15. An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial…CVE-2021-25829Onlyoffice · 7.4% likely

    Onlyoffice

16. An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access serv…CVE-2020-25097Squid-Cache · 7.3% likely

    CWE-444Squid-Cache

17. Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).CVE-2020-35682Zohocorp · 7.2% likely

    CWE-863Zoho (ManageEngine)

18. An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an execu…CVE-2021-26293Afterlogic · 7.1% likely

    CWE-22Afterlogic

19. Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-26893Microsoft · CVSS 9.8 · 7.0% likely

    Microsoft

20. Windows DNS Server Denial of Service VulnerabilityCVE-2021-27063Microsoft · CVSS 7.5 · 6.7% likely

    Microsoft

21. [20210306] - Core - com_media allowed paths that are not intended for image uploadsCVE-2021-23132Joomla! Project · 6.7% likely

    Joomla

22. A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below;…CVE-2021-25160Arubanetworks · 6.6% likely

    Arubanetworks

23. web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.CVE-2021-28379Vestacp · 6.0% likely

    CWE-434Vestacp

24. prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVirtualServerSettings…CVE-2021-28144Dlink · 6.0% likely

    CWE-78D-Link

25. Dell EMC OpenManage Server Administrator (OMSA) version 9.5 Microsoft Windows installations with Distributed Web Server (DWS) enabled configuration contains an authentication bypa…CVE-2021-21513Dell · CVSS 8.6 · 5.9% likely

    CWE-287Dell

26. Apache SpamAssassin has an OS Command Injection vulnerabilityCVE-2020-1946Apache Software Foundation · 5.9% likely

    CWE-78Apache

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.