Input Validation and Logic

Every one of the 834 is a mark on the map. Named now: 1 to 26, most at risk first.

1. A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote…CVE-2019-0604Microsoft · CVSS 9.8 · 100% likely

   CWE-20Handala HackThreat Group-33902 bounty reports

2. The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Go…CVE-2017-0148Microsoft Corporation · CVSS 8.1 · 99% likely

   CWE-20

3. Microsoft Outlook Elevation of Privilege VulnerabilityCVE-2023-23397Microsoft · CVSS 9.8 · 97% likely

   CWE-20

4. A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulner…CVE-2020-1350Microsoft · CVSS 10 · 97% likely

   CWE-20

5. Microsoft Outlook Remote Code Execution VulnerabilityCVE-2024-21413Microsoft · CVSS 9.8 · 95% likely

   CWE-20

6. The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows…CVE-2012-0151Microsoft · CVSS 7.8 · 88% likely

   CWE-20

7. Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-38112Microsoft · CVSS 7.5 · 84% likely

   CWE-451

8. A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Wi…CVE-2018-8414Microsoft · CVSS 8.8 · 73% likely

   CWE-20

9. Microsoft Office Security Feature Bypass VulnerabilityCVE-2026-21509Microsoft · CVSS 7.8 · 71% likelycovered by CyberSIXT

   CWE-807APT281 article

10. Microsoft Management Console Remote Code Execution VulnerabilityCVE-2024-43572Microsoft · CVSS 7.8 · 67% likely

    CWE-707

11. A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution…CVE-2019-1068Microsoft · CVSS 8.8 · 57% likelycovered by CyberSIXT

    CWE-209 articles

12. Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-43461Microsoft · CVSS 8.8 · 54% likely

    CWE-451

13. Microsoft SharePoint Server Spoofing VulnerabilityCVE-2026-32201Microsoft · CVSS 6.5 · 44% likelycovered by CyberSIXT

    CWE-201 article

14. Microsoft Management Console Security Feature Bypass VulnerabilityCVE-2025-26633Microsoft · CVSS 7 · 30% likely

    CWE-707

15. Microsoft WordPad Information Disclosure VulnerabilityCVE-2023-36563Microsoft · CVSS 6.5 · 20% likely

    CWE-20

16. Microsoft Word Information Disclosure VulnerabilityCVE-2023-36761Microsoft · CVSS 6.5 · 20% likely

    CWE-20

17. Microsoft Project Remote Code Execution VulnerabilityCVE-2024-38189Microsoft · CVSS 8.8 · 8.2% likely

    CWE-20

18. A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, a…CVE-2020-1040Microsoft · CVSS 9 · 7.6% likely

    CWE-20

19. Windows MSHTML Platform Security Feature Bypass VulnerabilityCVE-2024-30040Microsoft · CVSS 8.8 · 3.9% likely

    CWE-20

20. Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2025-32706Microsoft · CVSS 7.8 · 2.3% likely

    CWE-20

21. Microsoft Word Security Feature Bypass VulnerabilityCVE-2026-21514Microsoft · CVSS 7.8 · 1.6% likelycovered by CyberSIXT

    CWE-807

22. Microsoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityCVE-2023-21554Microsoft · CVSS 9.8 · 95% likely

    CWE-20

23. Microsoft Message Queuing (MSMQ) Denial of Service VulnerabilityCVE-2023-28302Microsoft · CVSS 7.5 · 93% likely

    CWE-20

24. The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to cause a den…CVE-2017-0004Microsoft · 89% likely

    CWE-20

25. The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll…CVE-2005-4360Microsoft · 87% likely

    CWE-252

26. The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a…CVE-2005-4560Microsoft · 86% likely

    CWE-20

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.