An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerabi
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system ver
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system ver
Possible Command Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0000.
Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200
Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.6.0000.
Possible External Service Interaction attack in iManager has been discovered in OpenText™ iManager 3.2.6.0000.
Possible Command injection Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000.
Possible Elevation of Privilege Vulnerability in iManager has been discovered in OpenText™ iManager. This impacts all v
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Firmanet Software
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Slider
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Slider
OS command injection vulnerability exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent authenticated attacker
Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom ap
An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: defer partition scanning We need t
In the Linux kernel, the following vulnerability has been resolved: virtio_pci: Fix admin vq cleanup by using correct i
In the Linux kernel, the following vulnerability has been resolved: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has
In the Linux kernel, the following vulnerability has been resolved: afs: Fix lock recursion afs_wake_up_async_call() c
While parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::out_of_range exception in
TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi.
TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in infostat.cgi.
authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was pos
TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification
Linksys E3000 1.0.06.002_US is vulnerable to command injection via the diag_ping_start function.
LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has bee
Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workfl
Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash.
Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies
Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies
Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies
An OS command injection vulnerability exists in the web interface configuration upload functionality of MC Technologies
A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vu
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknogis Informati
A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This
A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affe
A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms
ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or cra
FiveCo RAP dissector infinite loop in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet in
The Grid View Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1
The Contact Form 7 Email Add on plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and in
The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t
Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFT
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up t
Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerabilit
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parse
An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci pac
An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci pac
Incorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the compa
Frequently Asked Questions
What does HIGH severity mean for CVEs?
CVSS 7.0–8.9 — serious vulnerabilities that can lead to significant data exposure, privilege escalation, or service disruption
How many high severity CVEs exist?
There are 149,356 CVE records rated HIGH in our database. Of these, 381 are listed in CISA's Known Exploited Vulnerabilities catalog.
How should I prioritize high severity vulnerabilities?
HIGH severity vulnerabilities should be patched immediately, especially if they are in the CISA KEV catalog or have a high EPSS score. Use CyberStrike to automatically detect and prioritize these vulnerabilities across your infrastructure.
Detect HIGH Vulnerabilities
CyberStrike scans your infrastructure and detects high severity vulnerabilities in real time.
Get Started