Likely to be exploited (10% or more)

Every one of the 41 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 1…CVE-2021-2401Oracle Corporation · CVSS 5.3 · 85% likely

   CWE-611Oracle

2. Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 1…CVE-2021-2400Oracle Corporation · CVSS 7.5 · 83% likely

   Oracle

3. Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). The supported version that is affected…CVE-2021-2456Oracle Corporation · CVSS 9.8 · 81% likely

   Oracle

4. Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD.CVE-2021-31813Zohocorp · 78% likely

   CWE-79Zoho (ManageEngine)

5. Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affect…CVE-2021-35478Nagios · 77% likely

   CWE-79Nagios

6. Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.…CVE-2021-2394Oracle Corporation · CVSS 9.8 · 76% likely

   Oracle

7. Incorrect Transfer-Encoding handling with HTTP/1.0CVE-2021-33037Apache Software Foundation · 75% likely

   CWE-444Apache

8. In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.CVE-2021-32610Php · 73% likely

   CWE-59PHP

9. Authenticated SQL injection in Kaseya VSA < v9.5.6CVE-2021-30117Kaseya · CVSS 9.8 · 72% likely

   CWE-89Kaseya

10. Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by SpoofingCVE-2020-7388Sage · CVSS 10 · 69% likely

    CWE-290Sage

11. Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6CVE-2021-30119Kaseya · CVSS 5.4 · 59% likely

    CWE-79Kaseya

12. In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.CVE-2021-28966Ruby-Lang · 58% likely

    CWE-22Ruby-Lang1 bounty report

13. A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including ver…CVE-2021-33032Eq-3 · 52% likely

    CWE-78Eq-3

14. Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.CVE-2021-28114Froala · 52% likely

    CWE-79Froala

15. Microsoft Excel Remote Code Execution VulnerabilityCVE-2021-34501Microsoft · CVSS 7.8 · 52% likely

    Microsoft

16. Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Managemen…CVE-2020-36239Atlassian · CVSS 9.8 · 50% likely

    CWE-862Atlassian

17. Windows Print Spooler Remote Code Execution VulnerabilityCVE-2021-34481Microsoft · CVSS 8.8 · 48% likely

    CWE-269Microsoft

18. Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.CVE-2021-35042Djangoproject · 44% likely

    CWE-89Djangoproject

19. Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows…CVE-2021-2429Oracle Corporation · CVSS 5.9 · 41% likely

    Oracle

20. All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no per…CVE-2021-22146Elastic · 36% likely

    Elastic

21. Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 1…CVE-2021-2396Oracle Corporation · CVSS 8.8 · 36% likely

    Oracle

22. Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Scheduler). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and…CVE-2021-2391Oracle Corporation · CVSS 8.8 · 35% likely

    Oracle

23. Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized ActorCVE-2020-7387Sage · CVSS 5.3 · 34% likely

    CWE-200Sage

24. Integer overflow issues with *BIT commands on 32-bit systemsCVE-2021-32761redis · CVSS 7.5 · 30% likely

    CWE-125Redis

25. Unauthenticated XML External Entity vulnerability in Kaseya VSA < v9.5.6CVE-2021-30201Kaseya · CVSS 7.5 · 26% likely

    CWE-611Kaseya

26. Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased wit…CVE-2021-22918NodeJS · 23% likely

    CWE-125Node.js1 bounty report

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.