Unverified Ownership

Every one of the 36 is a mark on the map. Named now: 1 to 26, most at risk first.

1. OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact…CVE-2024-27903OpenVPN · CVSS 7.2 · 8.9% likely

   OpenVPN

2. Kubernetes man in the middle using LoadBalancer or ExternalIPsCVE-2020-8554Kubernetes · CVSS 6.3 · 8.7% likely

   Kubernetes

3. Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax ActionsCVE-2021-24501Amentotech · 1.3% likely

   AmentoTech

4. Workreap theme < 2.2.2 - Multiple CSRF + IDOR VulnerabilitiesCVE-2021-24500Amentotech · 0.6% likely

   AmentoTech

5. Improper Authorization in /user/namespace/{namespace}/detailsCVE-2025-1007Eclipse Foundation · CVSS 6.9 · 0.5% likely

   Eclipse Foundation

6. No verification of commits origin in github-action-merge-dependabotCVE-2022-29220fastify · CVSS 6.5 · 0.5% likely

   Fastify

7. TYPO3 CMS Vulnerable to Privilege Escalation to System MaintainerCVE-2025-47940TYPO3 · CVSS 7.2 · 0.5% likely

   Typo3

8. Unverified access point ownership in Amazon EFS CSI DriverCVE-2026-85781aws · CVSS 8.7 · 0.4% likely

   AWS

9. Missing S3 bucket ownership verification in the AWS Security Agent MCP serverCVE-2026-87913AWS · CVSS 5.9 · 0.4% likely

   AWS

10. Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecopsCVE-2026-87912AWS · CVSS 5.9 · 0.4% likely

    AWS

11. Kiwi TCMS may allow user to update email address to unverified oneCVE-2023-30544kiwitcms · CVSS 3.9 · 0.4% likely

    Kiwitcms

12. IBM Business Automation Insights unverified ownershipCVE-2025-36091IBM · CVSS 4.3 · 0.4% likely

    IBM

13. Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed AccountsCVE-2026-44707chatwoot · CVSS 6.8 · 0.3% likely

    Chatwoot

14. On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a…CVE-2023-6068Arista Networks · CVSS 3.1 · 0.3% likely

    Arista Networks

15. Vulnerabilities exists in IBM Netezza SoftwareCVE-2026-9745IBM · CVSS 6.5 · 0.3% likely

    IBM

16. OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process CleanupCVE-2026-27486openclaw · CVSS 4.3 · 0.3% likely

    OpenClaw

17. Windows Virtual Input Elevation of Privilege VulnerabilityCVE-2026-83791Microsoft · CVSS 7.8 · 0.3% likely

    Microsoft

18. An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote us…CVE-2025-12815AWS · CVSS 4.3 · 0.3% likely

    AWS

19. TSPortal: Anyone can forge self-deletion requests of any userCVE-2026-29788miraheze · CVSS 8.4 · 0.3% likely

    Miraheze

20. Windows Task Scheduler Elevation of Privilege VulnerabilityCVE-2026-88233Microsoft · CVSS 7.8 · 0.3% likely

    Microsoft

21. Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed apiCVE-2026-0598Red Hat · CVSS 4.2 · 0.2% likely

    Red Hat

22. Secret data extraction via elfinderCVE-2025-9822Mautic · CVSS 5.5 · 0.2% likely

    Mautic

23. Barman snapshot backup deletion trusts unverified backup catalog metadataCVE-2026-93853EnterpriseDB · CVSS 7.2 · 0.2% likely

    EnterpriseDB

24. Unverified ownership of the default EMR cluster log location in AWS SDK for pandasCVE-2026-127119AWS · CVSS 5.3 · 0.2% likely

    AWS

25. Zemana AntiLogger v2.74.204.664 - Arbitrary Process TerminationCVE-2024-1853Zemena · CVSS 5.5 · 0.2% likely
26. On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.CVE-2026-54467TrustedFirmware · CVSS 7 · 0.2% likely

    Trustedfirmware

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.