Inclusion of Web Functionality from an Untrusted Source

Every one of the 12 is a mark on the map. Named now: 1 to 12, most at risk first.

1. An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects De…CVE-2024-29944Mozilla · CVSS 8.4 · 4.7% likely

   Mozilla

2. Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (SSH)/web management services over the cl…CVE-2023-2588Teltonika · CVSS 8.8 · 1.1% likely

   Teltonika

3. In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.CVE-2021-28162The Eclipse Foundation · 0.8% likely

   Eclipse Foundation

4. os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a…CVE-2024-42381CVSS 8.3 · 0.6% likely
5. In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. This vulnerability allows attackers to bypass the Mark-of-t…CVE-2025-33028WinZip · CVSS 6.1 · 0.5% likely
6. In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not p…CVE-2025-46652IZArc · CVSS 6.1 · 0.3% likely
7. Minder does not sandbox http.send in Rego programsCVE-2025-65109mindersec · CVSS 8.5 · 0.3% likely
8. In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affe…CVE-2025-33027Bandisoft · CVSS 6.1 · 0.3% likely
9. In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected insta…CVE-2025-33026PeaZip · CVSS 6.1 · 0.3% likely

   PeaZip

10. OMERO.web JSONP callback vulnerabilityCVE-2024-35180ome · CVSS 6.1 · 0.3% likely

    Ome

11. An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowle…CVE-2025-43703Ankitects · CVSS 6.1 · 0.2% likely

    Ankitects

12. Inclusion of Web Functionality from an Untrusted Source on B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusCVE-2026-97358B. Braun Melsungen AG · CVSS 7

    B. Braun Melsungen AG

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.