Skip to content
OpenAdvisories

Archive

3 October 2025

Vulnerabilities first published on this day (UTC), newest first.

← September 2025 2025 / October /3 November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-49844 Public exploit Scanner template EPSS 83%

    Redis Lua Use-After-Free may lead to remote code execution

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code exe…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-46819 Public exploit Scanner template

    Redis is vulnerable to DoS via specially crafted LUA scripts

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 6.0
    CVE-2025-46818 Public exploit Scanner template

    Redis: Authenticated users can execute LUA scripts as a different user

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.0
    CVE-2025-46817 Public exploit Scanner template

    Lua library commands may lead to integer overflow and potential RCE

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all …

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2025-34226 Public exploit

    OpenPLC Runtime v3 Persistent DoS

    OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed u…

    Autonomy Logic OpenPLC Runtime
  • High 7.3
    CVE-2025-27237 Public exploit

    DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration

    In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.

    Zabbix Zabbix
  • Medium 6.4
    CVE-2025-9876 Public exploit

    Ird Slider <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Ird Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irdslider' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This ma…

    inforrada Ird Slider Web / CMS
  • Critical 9.8
    CVE-2025-9286 Public exploit

    Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password

    The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated …

    hancock11 Appy Pie Connect for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2025-9209 Public exploit Scanner template

    RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT

    The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This ma…

    magnigenie RestroPress – Online Food Ordering System Web / CMS
  • High 8.7
    CVE-2025-59536 Public exploit EPSS 25%

    Claude Code's startup trust dialog could lead to Command Execution attack

    Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup …

    anthropics claude-code @anthropic-ai/claude-code npm
  • High 7.5
    CVE-2025-55972 Public exploit

    A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Den…

  • Medium 4.7
    CVE-2025-55971 Public exploit

    TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to…

  • High 7.4
    CVE-2025-59489 Public exploit

    Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in load…

    Unity3D Unity Editor
  • High 7.2
    CVE-2025-60787 Public exploit EPSS 19%

    motionEye vulnerable to RCE via unsanitized motion config parameter

    MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve cod…

    motioneye PyPI