2025-10-03 - CVE Archive

CVE-2025-49844 Oct 03, 20:15 CRITICAL POC PATCH THREAT CISA Act Now

UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.

RCE Use After Free Memory Corruption Redis Red Hat +3

NVD GitHub

CVSS 3.1

9.9

EPSS

12.4%

Threat

5.9

CVE-2025-9209 Oct 03, 12:15 CRITICAL POC Act Now

Auth bypass in RestroPress WordPress ordering plugin 3.0.0-3.1.9.2.

PHP WordPress Authentication Bypass Information Disclosure

NVD

CVSS 3.1

9.8

EPSS

0.4%

CVE-2025-7721 Oct 03, 12:15 CRITICAL Act Now

LFI in JoomSport WordPress plugin.

PHP WordPress RCE Information Disclosure LFI

NVD

CVSS 3.1

9.8

EPSS

0.5%

CVE-2025-6388 Oct 03, 09:15 CRITICAL Act Now

Auth bypass in Spirit Framework WordPress plugin <= 1.2.14. EPSS 0.46%.

PHP WordPress Authentication Bypass

NVD

CVSS 3.1

9.8

EPSS

0.5%

CVE-2025-9286 Oct 03, 12:15 CRITICAL Act Now

Privilege escalation in Appy Pie Connect for WooCommerce via password reset.

WordPress Privilege Escalation

NVD

CVSS 3.1

9.8

EPSS

0.2%

CVE-2025-10547 Oct 03, 12:15 CRITICAL PATCH Act Now

Uninitialized variable in Vigor Routers DrayOS HTTP CGI. EPSS 0.06%.

Buffer Overflow

NVD

CVSS 3.1

9.8

EPSS

0.1%

CVE-2025-10729 Oct 03, 16:16 CRITICAL PATCH Act Now

Use-after-free in SVG pattern parsing — pattern node deleted but accessed later.

Denial Of Service Use After Free Memory Corruption

NVD VulDB

CVSS 4.0

9.4

EPSS

0.0%

CVE-2025-10728 Oct 03, 16:16 CRITICAL PATCH Act Now

Stack overflow DoS in SVG rendering via recursive pattern elements.

Buffer Overflow

NVD VulDB

CVSS 4.0

9.4

EPSS

0.0%

CVE-2025-40636 Oct 03, 12:15 CRITICAL Act Now

SQL injection in Joomla mod_vvisit_counter v2.0.4j3.

SQLi Joomla

NVD

CVSS 4.0

9.3

EPSS

0.0%

CVE-2025-10726 Oct 03, 12:15 CRITICAL Act Now

SQL injection in WPRecovery WordPress plugin.

PHP WordPress SQLi

NVD

CVSS 3.1

9.1

EPSS

0.2%