By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical file
By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical file
By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical fil
GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulner
lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quant
CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able t
Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.
IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity In
A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. Affected by this issue is the function f
python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of us
The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user infor
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerab
IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, and 6.1.0.0 could allow a remote attacker to traverse dire
A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthent
A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an
A vulnerability in the Modbus preprocessor of the Snort detection engine could allow an unauthenticated, remote attacker
A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local a
A vulnerability in Cisco RCM for Cisco StarOS Software could allow an unauthenticated, remote attacker to perf
An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file.
A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as critical. Affected by this vulne
A vulnerability in the local interface of Cisco BroadWorks Network Server could allow an unauthenticated, remote attacke
A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this
A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for Wo
The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and i
Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in tas
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all v
The Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, a
The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH serve
A heap-based buffer overflow in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service
A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service
A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service
Cross-Site Request Forgery (CSRF) vulnerability in gentlesource Appointmind appointmind allows Stored XSS.This issue aff
Cross-Site Request Forgery (CSRF) vulnerability in GeekRMX Twitter @Anywhere Plus twitter-anywhere-plus allows Stored XS
Cross-Site Request Forgery (CSRF) vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.Thi
A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.
Cross-Site Request Forgery (CSRF) vulnerability in Platform.ly Platform.ly Official platformly allows Stored XSS.This is
Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu W3P SEO wp-perfect-plugin allows Stored XSS.This issu
Cross-Site Request Forgery (CSRF) vulnerability in fraudlabspro FraudLabs Pro SMS Verification fraudlabs-pro-sms-verific
A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code.
A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing th
In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an email bom
parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input
Missing Authorization vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in On
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 DigiPass digipass
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DonnellC Global Gateway
A SQL Injection was found in /admin/admin_user.php in kashipara E-learning Management System Project 1.0 via the usernam
A SQL Injection vulnerability was found in /admin/calendar_of_events.php in kashipara E-learning Management System Proje
A SQL Injection vulnerability was found in /admin/edit_subject.php in kashipara E-learning Management System Project 1.0
Frequently Asked Questions
What does HIGH severity mean for CVEs?
CVSS 7.0–8.9 — serious vulnerabilities that can lead to significant data exposure, privilege escalation, or service disruption
How many high severity CVEs exist?
There are 149,356 CVE records rated HIGH in our database. Of these, 381 are listed in CISA's Known Exploited Vulnerabilities catalog.
How should I prioritize high severity vulnerabilities?
HIGH severity vulnerabilities should be patched immediately, especially if they are in the CISA KEV catalog or have a high EPSS score. Use CyberStrike to automatically detect and prioritize these vulnerabilities across your infrastructure.
Detect HIGH Vulnerabilities
CyberStrike scans your infrastructure and detects high severity vulnerabilities in real time.
Get Started