Incomplete List of Disallowed Inputs

Every one of the 216 is a mark on the map. Named now: 1 to 26, most at risk first.

1. ServiceNow - Incomplete Input ValidationCVE-2024-5217ServiceNow · CVSS 9.8 · 100% likely

   ServiceNow

2. Apache Kylin: Command injection by Useless configurationCVE-2022-43396Apache Software Foundation · CVSS 8.8 · 55% likely

   Apache

3. A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by s…CVE-2017-7525FasterXML · 38% likely

   Fasterxml

4. Incomplete Input Validation in SecurelyAccess APICVE-2024-5178ServiceNow · CVSS 4.9 · 34% likely

   ServiceNow

5. FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-…CVE-2018-7489Fasterxml · 20% likely

   Fasterxml

6. Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authen…CVE-2018-6383Monstra · 13% likely

   Monstra

7. A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fix…CVE-2024-32152Ankitects · CVSS 3.1 · 12% likely

   Ankitects

8. A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending t…CVE-2017-15095FasterXML · 8.4% likely

   Fasterxml

9. FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-1748…CVE-2018-5968Fasterxml · 7.2% likely

   Fasterxml

10. denylist of executable filename extensions possible to bypass under windowsCVE-2021-25631The Document Foundation · 5.0% likely

    The Document Foundation

11. Xerte Online Toolkits File Upload RCE via elfinder ConnectorCVE-2026-34415thexerteproject · CVSS 9.8 · 3.6% likely

    Thexerteproject

12. Microsoft Outlook Remote Code Execution VulnerabilityCVE-2024-30103Microsoft · CVSS 8.8 · 3.4% likely

    Microsoft

13. SolarWinds Platform Incomplete List of Disallowed Inputs VulnerabilityCVE-2023-23844SolarWinds · CVSS 7.2 · 3.0% likely

    SolarWinds

14. SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.su…CVE-2019-9212Antfin · 2.8% likely
15. Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLsCVE-2023-40037Apache Software Foundation · 2.1% likely

    Apache

16. Grav vulnerable to Server-side Template Injection (SSTI) via Denylist BypassCVE-2023-34253getgrav · CVSS 8.8 · 2.1% likely

    Getgrav

17. Grav Server-side Template Injection via Insufficient Validation in filterFilterCVE-2023-34252getgrav · CVSS 8.8 · 2.1% likely

    Getgrav

18. Improper Control of Generation of Code in Twig Rendered Views in ShopwareCVE-2023-2017Shopware AG · CVSS 8.8 · 2.1% likely

    Shopware

19. The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side requ…CVE-2017-0909HackerOne · 2.0% likely

    HackerOne1 bounty report

20. Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityCVE-2026-41264FlowiseAI · CVSS 9.2 · 1.8% likely

    FlowiseAI

21. Roo Code 3.54.0 Command Injection via Parameter Expansion ParsingCVE-2026-63108RooCodeInc · CVSS 8.8 · 1.8% likely

    RooCodeInc

22. A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with priv…CVE-2020-14372Gnu · 1.7% likely

    GNU

23. picklescan - Security scanning bypass via 'pip main'CVE-2025-1716mmaitre314 · CVSS 5.3 · 1.7% likely

    Mmaitre314

24. Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.CVE-2015-5946Sugarcrm · 1.7% likely

    Sugarcrm

25. rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects fo…CVE-2017-7540Red Hat, Inc. · 1.6% likely

    Red Hat

26. jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata…CVE-2017-2602Jenkins · CVSS 3.1 · 1.5% likely

    Jenkins

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.