MITM for HTTP and DNS are the main threats. An attacker can use one of these vectors to inject malicious JS into pages for you.

Otherwise, it depends on what else you use the network for. Maybe you set "SSL optional" in your mail client so your email password gets fired off in plaintext. Maybe your special radio streaming app is vulnerable to RCE. Maybe the latest Windows update accidently started sending your keylogs (ahem, "telemetry") over an unencrypted channel.

A favorite attack vector is various auto-updating software on your computer that downloads updates or update metadata over HTTP. For the longest time Sparkle (an update framework used in Mac apps such as VLC, iTerm, ..) defaulted to HTTP.

Once an attacker is in your network, it's more or less trivial to make that software connect to a malicious update server.

There's a limited amount of room to exploit this, this so long as signing is handled correctly. The Debian Apt system worked this way for a long time.

Of course, a lot of code signing systems are mismanaged, so...

If you run local dev servers and expose them they could be accessed.

Also IP addresses and domain names you visit are visible.

Fortunately for everyone, encrypted SNI is becoming a thing.

DNS queries are probably still visible though, and responses potentially poisoned.

If the network is open, your machine may be open to being sent traffic - or attacked - from other devices on the network.

How is this not true on an encrypted wifi or even an old-school wired office LAN?

Its one checkbox to turn on device isolation. It's not perfect, but suddenly no device can see any other device.