Incorrect Behavior Order

Every one of the 59 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Administrator with policy and NAT permissions can bypass Sync network protection on Scalable PlatformsCVE-2026-120490checkpoint · CVSS 3.8 · 8.4% likely

   Check Point

2. SolarWinds Platform Incorrect Behavior Order VulnerabilityCVE-2023-33224SolarWinds · CVSS 7.2 · 2.8% likely

   SolarWinds

3. Denial of Service of protobuf-java parsing procedureCVE-2021-22569Google LLC · CVSS 7.5 · 1.8% likely

   Google

4. Junos OS: MX Series: MPC 7/8/9/10/11 cards with MAP-E: PFE halts when an attacker sends malformed IPv4 or IPv6 traffic inside the MAP-E tunnel.CVE-2021-31379Juniper Networks · CVSS 7.5 · 1.3% likely

   Juniper Networks

5. Firewall bypass during shutdownCVE-2026-44108Phoenix Contact · CVSS 9.8 · 0.8% likely

   Phoenix Contact

6. GraphQL grant on a property might be cached with different objectsCVE-2025-31485api-platform · CVSS 7.5 · 0.6% likely

   Api-Platform

7. Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encodeCVE-2026-65100Apache Software Foundation · CVSS 4.8 · 0.6% likely

   Apache

8. Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.CVE-2025-48965Mbed · CVSS 4 · 0.6% likely

   Mbed

9. ads-tec Industrial IT: Account lockout via non-atomic user creationCVE-2026-14169ads-tec Industrial IT · CVSS 8.1 · 0.5% likely
10. Zoom Workplace Apps for iOS - Incorrect Behavior OrderCVE-2025-0150Zoom Communications, Inc · CVSS 7.1 · 0.5% likely

    Zoom Communications, Inc

11. OpenClaw < 2026.3.22 - Unauthenticated Cryptographic Work in Nostr Inbound DM HandlingCVE-2026-35627OpenClaw · CVSS 6.5 · 0.5% likely

    OpenClaw

12. In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.CVE-2026-44919OpenStack · CVSS 4.3 · 0.5% likely

    Openstack

13. MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_nee…CVE-2023-52968MariaDB · CVSS 4.9 · 0.5% likely

    Mariadb

14. Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerabilityCVE-2026-65219SMCI · CVSS 7.4 · 0.5% likelycovered by CyberSIXT

    SMCI1 article

15. OpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request ParsingCVE-2026-35640OpenClaw · CVSS 5.3 · 0.5% likely

    OpenClaw

16. OpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback DispatchCVE-2026-35652OpenClaw · CVSS 6.5 · 0.4% likely

    OpenClaw

17. cJSON JSON Patch Non-Atomic Application Destroys Data Before ValidationCVE-2026-67217DaveGamble · CVSS 5.3 · 0.4% likely

    Davegamble

18. GitPython validates a submodule's ".git" path only after cloning into it (RCE)CVE-2026-114145gitpython-developers · CVSS 7.5 · 0.4% likely

    Gitpython-Developers

19. Security Advisory 0222CVE-2026-121291Arista Networks · CVSS 8.2 · 0.4% likely

    Arista Networks

20. GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.CVE-2026-56355GNU · CVSS 3.7 · 0.4% likely

    GNU

21. ZKsync Era evaluation order of Yul function argumentsCVE-2024-35229matter-labs · CVSS 5.3 · 0.4% likely

    Matter-Labs

22. BMC Control-M/Agent improper IP address filtering orderCVE-2025-55114BMC · CVSS 5.3 · 0.4% likely

    Bmc

23. Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic…CVE-2025-9904Canon Inc. · CVSS 5.3 · 0.4% likely

    Canon Inc.

24. Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010.CVE-2026-44600torproject · CVSS 3.7 · 0.4% likely

    Torproject

25. Russh: Channel-scoped server callbacks can be reached without an open channelCVE-2026-68930Eugeny · CVSS 6.5 · 0.4% likely

    Eugeny

26. TYPO3 CMS - Security Misconfiguration in Form FrameworkCVE-2026-109162TYPO3 · CVSS 6.3 · 0.4% likely

    TYPO3

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.