Likely to be exploited (10% or more)

Every one of the 40 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site script…CVE-2021-21699Jenkins project · 88% likely

   CWE-79Jenkins

2. WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File UploadCVE-2021-42362WordPress Popular Posts · CVSS 8.8 · 80% likely

   CWE-434

3. Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.CVE-2021-33618Dolibarr · 79% likely

   CWE-79Dolibarr

4. A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provide…CVE-2021-41950Montala · 75% likely

   CWE-22Montala

5. Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.CVE-2021-42847Zohocorp · 70% likely

   Zoho (ManageEngine)

6. A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL command…CVE-2021-41765Montala · 68% likely

   CWE-89Montala

7. Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.CVE-2021-41081Zohocorp · 64% likely

   CWE-89Zoho (ManageEngine)

8. Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.CVE-2021-39906GitLab · CVSS 8.7 · 61% likely

   CWE-79GitLab

9. An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploi…CVE-2021-43267Linux · 58% likely

   CWE-1284Linux

10. Adobe Bridge Buffer Overflow Arbitrary code executionCVE-2021-42727Adobe · CVSS 7.8 · 39% likely

    CWE-787Adobe

11. mySCADA myDESIGNERCVE-2021-43555mySCADA · CVSS 7.3 · 38% likely

    CWE-23mySCADA

12. Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service a…CVE-2021-42697Akka · 36% likely

    CWE-674

13. An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric).CVE-2021-43405Fusionpbx · 36% likely

    Fusionpbx

14. The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user v…CVE-2020-16152Extremenetworks · 36% likely

    CWE-829Extremenetworks

15. iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability by sending a…CVE-2021-36300Dell · CVSS 6.5 · 33% likely

    CWE-89Dell

16. PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)CVE-2021-3060Palo Alto Networks · CVSS 8.1 · 33% likely

    CWE-78Palo Alto Networks

17. Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges…CVE-2021-36299Dell · CVSS 7.1 · 30% likely

    CWE-89Dell

18. WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPres…CVE-2021-44223Wordpress · CVSS 8.1 · 29% likely

    WordPress

19. Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker may potentially exploi…CVE-2021-36301Dell · CVSS 5.9 · 28% likely

    CWE-121Dell

20. Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2021-38001Google · 27% likely

    CWE-843Google

21. Path traversal in translator module of NobeBBCVE-2021-43788NodeBB · CVSS 5 · 26% likely

    CWE-22NodeBB

22. Special characters break path parsing in XML functionsCVE-2021-21707PHP Group · CVSS 5.3 · 25% likely

    CWE-159PHP

23. The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-…CVE-2002-20001Balasys · 25% likely

    CWE-400

24. A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher_avatar.php. Once an…CVE-2021-42669Engineers Online Portal Project · 23% likely

    CWE-434Engineers Online Portal Project

25. Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality.CVE-2021-43319Zohocorp · 21% likely

    CWE-77Zoho (ManageEngine)

26. PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway InterfacesCVE-2021-3064Palo Alto Networks · CVSS 9.8 · 20% likely

    CWE-121Palo Alto Networks

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.