Improper Neutralization of Encoded URI Schemes in a Web Page

Every one of the 21 is a mark on the map. Named now: 1 to 21, most at risk first.

1. Plex Media Server < 1.43.3.10861 - Server Side Request ForgeryCVE-2026-96654Plex · CVSS 6.5 · 1.9% likelycovered by CyberSIXT

   Plex10 articles4 articles this week: Plex2Shell Flaws Exploited to Hack Internet Facing NAS Devices

2. A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.12…CVE-2022-40181Siemens · 1.0% likely

   Siemens

3. Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a resu…CVE-2020-7011Elastic · 1.0% likely

   Elastic

4. OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.CVE-2021-3824OpenVPN Access Server · 0.7% likely
5. MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP ServerCVE-2025-58444modelcontextprotocol · CVSS 8.6 · 0.7% likely

   Model Context Protocol

6. Backstage has XSS Vulnerability in Software CatalogCVE-2023-25571backstage · CVSS 6.8 · 0.5% likely

   Backstage

7. Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restrictionCVE-2026-88859Red Hat · CVSS 6.3 · 0.4% likely

   Red Hat

8. Stored XSS via javascript URI in Apollo Change Requests commentCVE-2023-30959Palantir · CVSS 4.1 · 0.4% likely

   Palantir

9. Tuleap allows XSS via the content of RSS feeds in the RSS widgetsCVE-2025-30203Enalean · CVSS 4.8 · 0.3% likely

   Enalean

10. JupyterLab before 4.5.9 Stored XSS via Extension ManagerCVE-2026-67338jupyterlab · CVSS 6.1 · 0.3% likely

    Jupyterlab

11. JavaScript Injection via url encoded values in links in Collabora Office AndroidCVE-2024-45045CollaboraOnline · CVSS 6.3 · 0.3% likely

    CollaboraOnline

12. IBM Engineering Lifecycle Optimization - Publishing cross-site scriptingCVE-2024-52890IBM · CVSS 6.1 · 0.2% likely

    IBM

13. An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted link.CVE-2025-25334CVSS 5.5 · 0.2% likely
14. An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link.CVE-2025-25331CVSS 5.5 · 0.2% likely
15. An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link.CVE-2025-25330CVSS 5.5 · 0.2% likely
16. An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user information via supplying a crafted link.CVE-2025-25329CVSS 5.5 · 0.2% likely
17. An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link.CVE-2025-25326CVSS 5.5 · 0.2% likely
18. An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information via supplying a crafted link.CVE-2025-25325CVSS 5.5 · 0.2% likely
19. An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a crafted link.CVE-2025-25324CVSS 5.5 · 0.2% likely
20. An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user information via supplying a crafted link.CVE-2025-25323CVSS 5.5 · 0.2% likely
21. HCL BigFix Patch Download Plug-ins are affected by insecure support for file URI schemeCVE-2024-42184HCL Software · CVSS 2.5 · 0.1% likely

    HCL Software

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.