Patchfirst: redis vulnerabilitieshttps://patchfirst.co/vendor/redis/New and newly exploited redis CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-25243: redis-server RESTORE invalid memory access may allow remote code executionhttps://patchfirst.co/cve/CVE-2026-25243/CVE-2026-25243Tue, 05 May 2026 00:00:00 GMTredis · redis. Not in CISA KEV. EPSS 4.0% (higher than 90.6% of CVEs). CVSS 7.7 HIGH. Public exploit code exists. Priority 75.9 of 100.public-exploitCVE-2025-49844: Redis Lua Use-After-Free may lead to remote code executionhttps://patchfirst.co/cve/CVE-2025-49844/CVE-2025-49844Fri, 03 Oct 2025 00:00:00 GMTredis · redis. Not in CISA KEV. EPSS 82.6% (higher than 99.67% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 83.5 of 100.public-exploitCVE-2023-36824: Heap overflow in COMMAND GETKEYS and ACL evaluation in Redishttps://patchfirst.co/cve/CVE-2023-36824/CVE-2023-36824Tue, 11 Jul 2023 00:00:00 GMTredis · redis. Not in CISA KEV. EPSS 77.4% (higher than 99.56% of CVEs). CVSS 7.4 HIGH. Priority 25.8 of 100.CVE-2023-28425: Specially crafted MSETNX command can lead to denial-of-servicehttps://patchfirst.co/cve/CVE-2023-28425/CVE-2023-28425Mon, 20 Mar 2023 00:00:00 GMTredis · redis. Not in CISA KEV. EPSS 58.5% (higher than 99.1% of CVEs). CVSS 5.5 MEDIUM. Priority 23.7 of 100.CVE-2022-36021: Redis string pattern matching can be abused to achieve Denial of Servicehttps://patchfirst.co/cve/CVE-2022-36021/CVE-2022-36021Wed, 01 Mar 2023 00:00:00 GMTredis · redis. Not in CISA KEV. EPSS 59.8% (higher than 99.13% of CVEs). CVSS 5.5 MEDIUM. Priority 23.7 of 100.CVE-2023-22458: Integer overflow in multiple Redis commands can lead to denial-of-servicehttps://patchfirst.co/cve/CVE-2023-22458/CVE-2023-22458Fri, 20 Jan 2023 00:00:00 GMTredis · redis. Not in CISA KEV. EPSS 72.0% (higher than 99.43% of CVEs). CVSS 5.5 MEDIUM. Priority 23.7 of 100.[KEV] CVE-2022-0543: Debian-specific Redis Server Lua Sandbox Escape Vulnerabilityhttps://patchfirst.co/cve/CVE-2022-0543/CVE-2022-0543#kevMon, 28 Mar 2022 00:00:00 GMTRedis · Debian-specific Redis Servers. In CISA KEV since 2022-03-28. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 70.0 of 100.kevpublic-exploitT1190T1059