Improper Protection of Alternate Path

Every one of the 54 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Yii2 PHP Framework < 2.0.52 - Remote Code ExecutionCVE-2024-58136yiiframework · CVSS 9 · 88% likely

   Yiiframework

2. vBulletin 5.0.0-6.0.3 - Authentication BypassCVE-2025-48827vBulletin · CVSS 10 · 76% likelycovered by CyberSIXT

   Vbulletin

3. vBulletin replaceAdTemplate - Remote Code ExecutionCVE-2025-48828vBulletin · CVSS 9 · 57% likelycovered by CyberSIXT

   Vbulletin

4. PB610 HMISimulator provides interface with access to arbitrary filesCVE-2019-18997ABB · CVSS 4.3 · 1.5% likely

   ABB

5. A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of…CVE-2023-20272Cisco · CVSS 6.7 · 0.9% likely

   Cisco

6. Windows FileCrypt Driver Security Feature Bypass VulnerabilityCVE-2026-113756Microsoft · CVSS 5.3 · 0.8% likely

   Microsoft

7. Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=falseCVE-2026-66756Apache Software Foundation · CVSS 6.9 · 0.7% likely

   Apache

8. An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the same network as the dev…CVE-2021-3793Motorola · CVSS 6.5 · 0.7% likely

   Motorola

9. ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controlsCVE-2026-82754ash-project · CVSS 6.3 · 0.7% likely

   Ash-Project

10. Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API RoutesCVE-2026-114659getgrav · CVSS 6.5 · 0.6% likely

    Getgrav

11. Improper Protection of Alternate Path in GitLabCVE-2024-8311GitLab · CVSS 6.5 · 0.6% likely

    GitLab

12. Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.CVE-2026-4913Ivanti · CVSS 5.7 · 0.6% likelycovered by CyberSIXT

    Ivanti

13. AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributesCVE-2026-82586ash-project · CVSS 8.2 · 0.5% likely

    Ash-Project

14. PostgreSQL security-restricted operations can create types in pg_temp, which later queries of the session findCVE-2026-116316PostgreSQL · CVSS 8.8 · 0.5% likely
15. Windows FileCrypt Driver Information Disclosure VulnerabilityCVE-2026-113757Microsoft · CVSS 5.5 · 0.5% likely

    Microsoft

16. Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)CVE-2026-58428Gitea · CVSS 6.5 · 0.5% likely

    Gitea

17. PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a…CVE-2026-86145PCRE · CVSS 8.2 · 0.4% likely

    Pcre

18. Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email BypassCVE-2024-3927bdthemes · CVSS 5.3 · 0.4% likely

    BdThemes

19. Windows Composite Image File System Information Disclosure VulnerabilityCVE-2026-112809Microsoft · CVSS 5.5 · 0.4% likely

    Microsoft

20. Windows Cloud Files Mini Filter Driver Information Disclosure VulnerabilityCVE-2026-112803Microsoft · CVSS 5.5 · 0.4% likely

    Microsoft

21. ABB PB610 HMIStudio accepts malicious DLL file in an applicationCVE-2019-18996ABB · CVSS 7.1 · 0.4% likely

    ABB

22. Improper Protection of Alternate Path in Splunk SOARCVE-2026-76529Splunk · CVSS 9.8 · 0.4% likely

    Splunk

23. Windows AppX Deployment Service Security Feature Bypass VulnerabilityCVE-2026-69979Microsoft · CVSS 5.5 · 0.4% likely

    Microsoft

24. Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.CVE-2025-68939Gitea · CVSS 8.2 · 0.3% likely

    Gitea

25. Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shellCVE-2023-5165Docker Inc. · CVSS 7.1 · 0.3% likely

    Docker

26. In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI…CVE-2026-54423OpenStack · CVSS 8.2 · 0.3% likely

    Openstack

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.