A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw
A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw
A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw
IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE)
An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows rem
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthentica
SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticate
DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated atta
Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb ver
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS versio
Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilitie
Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Improper Restriction of Communication Channel to Intend
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installa
The WPFront User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and
In the Linux kernel, the following vulnerability has been resolved: mm/migrate: fix shmem xarray update during migratio
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unconditionally save+flush host FPSIMD/
In the Linux kernel, the following vulnerability has been resolved: Revert "arm64: dts: qcom: sdm845: Affirm IDR0.CCTW
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected de
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected de
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected de
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in
SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could a
Due to directory traversal vulnerability, an authorized attacker could gain access to some critical information by using
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function
Improper handling of exceptional conditions in pairing specific bluetooth devices in Galaxy Watch Bluetooth pairing prio
Improper access control in HDCP trustlet prior to SMR Apr-2025 Release 1 allows local attackers with shell privilege to
A vulnerability has been found in ESAFENET CDG 5.6.3.154.205_20250114 and classified as critical. This vulnerability aff
A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. This affects an unk
A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5.6.3.154.205_20250114. Affected by th
The Streamit theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and i
The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'st_
Ratta SuperNote A6 X2 Nomad before December 2024 allows remote code execution because an arbitrary firmware image (signe
The DB chooser functionality in Jalios JPlatform 10 SP6 before 10.0.6 improperly neutralizes special elements used in an
A vulnerability was found in 1000 Projects Human Resource Management System 1.0. It has been classified as critical. Aff
A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0 and classified as critical.
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph th
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph th
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph th
Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to
Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to
apollo-compiler is a query-based compiler for the GraphQL query language. Prior to 1.27.0, a vulnerability in Apollo Com
A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. Affected by this issue is s
A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. Affected by this vulnerability is an unknown
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. Affected is an unknown function of the
A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. This issue affects some unknown proc
A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknow
A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of
Frequently Asked Questions
What does HIGH severity mean for CVEs?
CVSS 7.0–8.9 — serious vulnerabilities that can lead to significant data exposure, privilege escalation, or service disruption
How many high severity CVEs exist?
There are 143,102 CVE records rated HIGH in our database. Of these, 363 are listed in CISA's Known Exploited Vulnerabilities catalog.
How should I prioritize high severity vulnerabilities?
HIGH severity vulnerabilities should be patched immediately, especially if they are in the CISA KEV catalog or have a high EPSS score. Use CyberStrike to automatically detect and prioritize these vulnerabilities across your infrastructure.
Detect HIGH Vulnerabilities
CyberStrike scans your infrastructure and detects high severity vulnerabilities in real time.
Get Started