Acceptance of Extraneous Untrusted Data With Trusted Data

Every one of the 48 is a mark on the map. Named now: 1 to 26, most at risk first.

1. iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command executionCVE-2019-9535iTerm2 · 2.5% likely

   Iterm2

2. Windows COM Elevation of Privilege VulnerabilityCVE-2026-32162Microsoft · CVSS 8.4 · 2.0% likely

   Microsoft

3. Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could…CVE-2018-1131Red Hat, Inc. · 1.2% likely

   Red Hat

4. Windows BitLocker Security Feature Bypass VulnerabilityCVE-2025-48804Microsoft · CVSS 6.8 · 0.8% likelycovered by CyberSIXT

   Microsoft

5. Cache poisoning attacks with unsolicited RRsCVE-2025-40778ISC · CVSS 8.6 · 0.8% likely

   Isc

6. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected…CVE-2024-21094Oracle Corporation · CVSS 3.7 · 0.8% likely

   Oracle

7. Microsoft Word Security Feature Bypass VulnerabilityCVE-2025-29816Microsoft · CVSS 7.5 · 0.5% likely

   Microsoft

8. UrlMon Security Feature Bypass VulnerabilityCVE-2025-29842Microsoft · CVSS 7.5 · 0.4% likely

   Microsoft

9. Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2CVE-2020-8023SUSE · CVSS 7.7 · 0.4% likely

   SUSE

10. DNSJava DNSSEC BypassCVE-2024-25638dnsjava · CVSS 8.9 · 0.4% likely
11. Nuxt allows DOS via cache poisoning with payload rendering responseCVE-2025-27415nuxt · CVSS 7.5 · 0.4% likely

    Nuxt

12. Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remot…CVE-2026-41120Dell · CVSS 9.8 · 0.4% likelycovered by CyberSIXT

    Dell

13. NGINX vulnerabilityCVE-2026-1642F5 · CVSS 5.9 · 0.4% likely

    F5

14. A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions <…CVE-2023-44317Siemens · CVSS 7.2 · 0.4% likely

    Siemens

15. Windows Dynamic Host Configuration Protocol (DHCP) Tampering VulnerabilityCVE-2026-45602Microsoft · CVSS 9.1 · 0.4% likely

    Microsoft

16. A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The…CVE-2020-10751The Linux Foundation · CVSS 6.1 · 0.3% likely

    Linuxfoundation

17. In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configurationCVE-2023-51655JetBrains · CVSS 6.3 · 0.3% likely

    JetBrains

18. Possible domain hijacking via promiscuous records in the authority sectionCVE-2025-11411NLnet Labs · CVSS 5.7 · 0.3% likely

    NLnet Labs

19. Moodle: cache poisoning risk with endpoint revision numbersCVE-2023-5548Moodle · CVSS 3.3 · 0.3% likely

    Moodle

20. ESP-NOW Replay Attacks VulnerabilityCVE-2024-42483espressif · CVSS 6.5 · 0.3% likely

    Espressif

21. Next.js: Middleware / Proxy redirects can be cache-poisonedCVE-2026-44572vercel · CVSS 3.7 · 0.3% likely

    Vercel

22. Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative…CVE-2024-41924EC-CUBE CO.,LTD. · CVSS 7.2 · 0.3% likely

    EC-CUBE CO.,LTD.

23. Possible cache poisoning via promiscuous records for the authority sectionCVE-2026-42960NLnet Labs · CVSS 5.7 · 0.3% likely

    NLnet Labs

24. Logon bypass (trust of attacker-controlled completed-methods list)CVE-2026-112256OpenText · CVSS 9.2 · 0.2% likely

    OpenText

25. Unauthenticated IXFR deltas are applied to the live zone before TSIG verificationCVE-2026-19033ISC · CVSS 6.5 · 0.2% likely

    Isc

26. WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache PoisoningCVE-2025-11703wpgmaps · CVSS 5.3 · 0.2% likely

    WPGMaps

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.