Likely to be exploited (10% or more)

Every one of the 40 is a mark on the map. Named now: 1 to 26, most at risk first.

1. An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.…CVE-2021-31643Chiyu-Tech · 88% likely

   CWE-79Chiyu-Tech

2. An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute…CVE-2021-22123Fortinet · CVSS 7.6 · 84% likely

   CWE-78Fortinet

3. Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Con…CVE-2021-21668Jenkins project · 76% likely

   CWE-79Jenkins

4. Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitab…CVE-2021-21667Jenkins project · 76% likely

   CWE-79Jenkins

5. Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.CVE-2021-28958Zohocorp · 73% likely

   CWE-78Zoho (ManageEngine)

6. Apache HTTP Server mod_session response handling heap overflowCVE-2021-26691Apache Software Foundation · 68% likely

   CWE-122Apache

7. Bello < 1.6.0 - Unauthenticated Blind SQL InjectionCVE-2021-24321BoldThemes · 67% likely

   CWE-89BoldThemes

8. mod_session NULL pointer dereferenceCVE-2021-26690Apache Software Foundation · 65% likely

   CWE-476Apache

9. curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A mali…CVE-2021-22901Haxx · 64% likely

   CWE-416Haxx2 bounty reports

10. mod_proxy_wstunnel tunneling of non Upgraded connectionsCVE-2019-17567Apache Software Foundation · 60% likely

    CWE-444Apache

11. lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could pot…CVE-2021-33393Ipfire · 59% likely

    Ipfire

12. Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads…CVE-2021-3277Nagios · 59% likely

    CWE-434Nagios

13. A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting i…CVE-2021-23017F5 · 53% likely

    CWE-193F51 bounty report

14. mod_auth_digest possible stack overflow by one nul byteCVE-2020-35452Apache Software Foundation · 53% likely

    CWE-787Apache

15. Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privil…CVE-2021-20081Zohocorp · 52% likely

    Zoho (ManageEngine)

16. NULL pointer dereference on specially crafted HTTP/2 requestCVE-2021-31618Apache Software Foundation · 52% likely

    CWE-476Apache

17. Unexpected URL matching with 'MergeSlashes OFF'CVE-2021-30641Apache Software Foundation · 52% likely

    Apache

18. mod_proxy_http NULL pointer dereferenceCVE-2020-13950Apache Software Foundation · 50% likely

    CWE-476Apache

19. Windows DCOM Server Security Feature BypassCVE-2021-26414Microsoft · CVSS 4.8 · 50% likely

    Microsoft

20. Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.CVE-2021-31586Accellion · 44% likely

    CWE-89Accellion

21. A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulner…CVE-2021-31642Chiyu-Tech · 44% likely

    CWE-190Chiyu-Tech

22. Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2021-21672Jenkins project · 43% likely

    CWE-611Jenkins

23. XSS vulnerability with translatorCVE-2021-32671flarum · CVSS 10 · 40% likely

    CWE-79Flarum

24. An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileged connection with t…CVE-2021-31251Chiyu-Tech · 36% likely

    CWE-287Chiyu-Tech

25. A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or c…CVE-2021-20093Wibu · 33% likely

    CWE-125Wibu

26. An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploited by sending a lin…CVE-2021-31252Chiyu-Tech · 29% likely

    CWE-601Chiyu-Tech

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.