crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-o
amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition
Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 vers
Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.
Subscriber SQL Injection in Reviewer <= 3.14.2 versions.
Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.
Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.
Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.
Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.
Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checko
Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.
Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.
Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.
Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.
Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.
Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.
Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.
Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.
Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.
Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.
Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.
Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Un
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 vers
Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.
Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.
Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.
Subscriber SQL Injection in CubeWP <= 1.1.30 versions.
Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.
Subscriber Path Traversal in Do Lasso <= 358 versions.
Subscriber SQL Injection in Do Lasso <= 358 versions.
Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.
Frequently Asked Questions
What does HIGH severity mean for CVEs?
CVSS 7.0–8.9 — serious vulnerabilities that can lead to significant data exposure, privilege escalation, or service disruption
How many high severity CVEs exist?
There are 143,102 CVE records rated HIGH in our database. Of these, 363 are listed in CISA's Known Exploited Vulnerabilities catalog.
How should I prioritize high severity vulnerabilities?
HIGH severity vulnerabilities should be patched immediately, especially if they are in the CISA KEV catalog or have a high EPSS score. Use CyberStrike to automatically detect and prioritize these vulnerabilities across your infrastructure.
Detect HIGH Vulnerabilities
CyberStrike scans your infrastructure and detects high severity vulnerabilities in real time.
Get Started