Misinterpretation of Input

Every one of the 33 is a mark on the map. Named now: 1 to 26, most at risk first.

1. A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confide…CVE-2020-27846crewjam/saml · 4.9% likely
2. Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option o…CVE-2018-12116The Node.js Project · 4.6% likely

   Node.js

3. Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() t…CVE-2018-12123The Node.js Project · 4.0% likely

   Node.js

4. The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value…CVE-2018-7159The Node.js Project · 3.5% likely

   Node.js

5. The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker t…CVE-2020-29509Golang · CVSS 9.8 · 2.1% likely
6. The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft…CVE-2020-29510Golang · CVSS 9.8 · 2.1% likely
7. The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to…CVE-2020-29511Golang · CVSS 9.8 · 2.0% likely
8. Usage of disabled protocolCVE-2024-2004curl · CVSS 3.5 · 1.7% likely

   The Curl Project

9. Cisco NX-OS Software VXLAN OAM (NGOAM) Denial of Service VulnerabilityCVE-2021-1587Cisco · CVSS 8.6 · 1.7% likely

   Cisco

10. Misinterpretation of malicious XML inputCVE-2021-21366xmldom · CVSS 4.3 · 1.3% likely

    Xmldom

11. NFX250, NFX350, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series: Certain genuine traffic received by the Junos OS device will be discarded instead o…CVE-2021-0207Juniper Networks · CVSS 7.5 · 1.3% likely

    Juniper Networks

12. Unhandled Exception Leading to Server Crash in danny-avila/librechatCVE-2024-11169danny-avila · CVSS 7.5 · 0.9% likely

    Danny-Avila

13. Misinterpretation of Input in ionicabizau/parse-urlCVE-2022-3224ionicabizau · CVSS 9.4 · 0.8% likely

    IonicaBizau

14. Apache Kvrocks: Cross-Protocol Scripting VulnerabilityCVE-2025-25069Apache Software Foundation · CVSS 6.5 · 0.8% likely

    Apache

15. URL Confusion When Scheme Not Supplied in medialize/uri.jsCVE-2022-1233medialize · CVSS 6.5 · 0.8% likely

    Medialize

16. /etc/pki/tls and /etc/ssl/certs include distrusted certificates in make-caCVE-2022-21672lfs-book · CVSS 6.5 · 0.7% likely
17. Libsoup: denial of service on libsoup through http/2 serverCVE-2025-32908Redhat · CVSS 7.5 · 0.6% likely

    Red Hat

18. Misinterpretation of Input in thorsten/phpmyfaqCVE-2023-0880thorsten · CVSS 8.3 · 0.6% likely

    Thorsten

19. GitProxy is vulnerable to a packfile parsing exploitCVE-2025-54584finos · CVSS 7 · 0.6% likely
20. Unexpected paths returned from LookPath in os/execCVE-2025-47906Go standard library · CVSS 6.5 · 0.5% likely

    Go standard library

21. ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and ReplayCVE-2025-68113altcha-org · CVSS 6.5 · 0.5% likely
22. HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netCVE-2025-22870Go standard library · CVSS 4.4 · 0.4% likely

    Go standard library

23. A potential Misinterpretation of Input vulnerability has been identified in SMAX, AMX, and HCMX products.CVE-2023-32260OpenText™ · CVSS 6.5 · 0.4% likely

    OpenText

24. WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution VulnerabilityCVE-2025-5747WOLFBOX · CVSS 8 · 0.4% likely

    WOLFBOX

25. HPE NonStop DNS 9.2.3 Non Secure VersionCVE-2026-73798Hewlett Packard Enterprise · CVSS 8.2 · 0.3% likely

    Hewlett Packard Enterprise

26. Dulwich before 1.2.20 Commit Parser Tree Header MisinterpretationCVE-2026-122299jelmer · CVSS 8.8 · 0.3% likely

    Jelmer

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.