Mailman

Every one of the 46 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.CVE-2015-2775Gnu · 7.9% likely

   CWE-22

2. Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2006-3636Gnu · 6.9% likely
3. Cross-site scripting vulnerabilities in Mailman before 2.0.11 allow remote attackers to execute script via (1) the admin login page, or (2) the Pipermail index summaries.CVE-2002-0388Gnu · 6.3% likely
4. Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber's list subscription options in the (1) adminp…CVE-2002-0855Gnu · 6.1% likely
5. Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters.CVE-2003-0038Gnu · 4.8% likely
6. Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.CVE-2018-5950Gnu · 4.6% likely

   CWE-79

7. Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) f…CVE-2011-0707Gnu · 4.2% likely

   CWE-79

8. Mailman 2.1.4 through 2.1.6 allows remote attackers to cause a denial of service via a message that causes the server to "fail with an Overflow on bad date data in a processed mes…CVE-2005-4153Gnu · 3.1% likely
9. Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server.CVE-2004-0412Gnu · 3.0% likely
10. CRLF injection vulnerability in Utils.py in Mailman before 2.1.9rc1 allows remote attackers to spoof messages in the error log and possibly trick the administrator into visiting m…CVE-2006-4624Gnu · 3.0% likely

    CWE-94

11. Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences…CVE-2005-0202Gnu · 2.9% likely

    2 bounty reports

12. Scrubber.py in Mailman 2.1.5-8 does not properly handle UTF8 character encodings in filenames of e-mail attachments, which allows remote attackers to cause a denial of service (ap…CVE-2005-3573Gnu · 2.7% likely
13. /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.CVE-2020-12108Gnu · 2.7% likely

    CWE-74

14. The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing lis…CVE-2006-0052Gnu · 2.7% likely
15. Format string vulnerability in Mailman before 2.1.9 allows attackers to execute arbitrary code via unspecified vectors. NOTE: the vendor has disputed this vulnerability, stating t…CVE-2006-2191Gnu · 2.7% likely
16. Mailman before 2.1.9rc1 allows remote attackers to cause a denial of service via unspecified vectors involving "standards-breaking RFC 2231 formatted headers".CVE-2006-2941Gnu · 2.7% likely
17. An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.CVE-2018-13796Gnu · 2.5% likely

    CWE-20

18. Mailman 2.0.x before 2.0.6 allows remote attackers to gain access to list administrative pages when there is an empty site or list password, which is not properly handled during t…CVE-2001-1132Gnu · 2.5% likely
19. GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors,…CVE-2020-12137Gnu · 2.3% likely

    CWE-79

20. Cross-site scripting (XSS) vulnerability in the admin CGI script for Mailman before 2.1.4 allows remote attackers to steal session cookies and conduct unauthorized activities.CVE-2003-0965Gnu · 2.0% likely
21. Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (…CVE-2010-3089Gnu · 2.0% likely

    CWE-79

22. Unknown vulnerability in the mail command handler in Mailman before 2.0.14 allows remote attackers to cause a denial of service (crash) via malformed e-mail commands.CVE-2003-0991Gnu · 1.9% likely
23. GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.CVE-2020-15011Gnu · 1.9% likely

    CWE-74

24. Cross-site scripting vulnerability in Mailman email archiver before 2.08 allows attackers to obtain sensitive information or authentication credentials via a malicious link that i…CVE-2001-0884Gnu · 1.9% likely
25. Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not proper…CVE-2004-1177Gnu · 1.8% likely
26. The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.CVE-2004-1143Gnu · 1.6% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.