Very severe. Once the vulnerability is exploited, it might result in loss of large amount of assets directly.
To elaborate a bit: There might exist an integer underflow in the contract code, which can be exploited by attackers to steal funds or execute malicious transfers, etc.

There might exist an integer overflow in the contract code, which can be exploited by attackers to steal funds.

There are vulnerabilities in message call to external contract. Attackers can exploit them with double spend attacks and malicious transfers.

To some extent at risk.
Status of contract has been changed after external call. Attackers can repeatedly exploit this vulnerability and it might result in business logic errors.

To some extent at risk.
Vulnerabilities found with the function call and the contract might not be executed properly.

Multiple sends exist in one transaction. This might lead to instability in contract execution.