CVE-2025-13465: Improperly Controlled Modification of Object Prototype Attributes

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the .unset and .omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original...

CVE-2020-10790

openITCOCKPIT before 3.7.3 has unnecessary files such as Lodash files under the web root, which leads to XSS...

Security Bulletin: Multiple security vulnerabilities are addressed with Cloud Pak foundational services 4.15.0 shipped with IBM Cloud Pak for Business Automation iFixes for December 2025.

Summary IBM Cloud Pak for Business Automation includes IBM Cloud Pak foundational services. IBM Cloud Pak for Business Automation December 2025 security fixes update this dependency beyond 4.15.0 to address security vulnerabilities. Vulnerability Details CVEID:CVE-2016-10540 DESCRIPTION: Minimatc...

Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Prototype Pollution flaw due to lodash.clonedeep

Summary lodash.clonedeep is used by BM watsonx Orchestrate Developer Edition as part of images: agentic-task-manager, wxo-builder-ui, wxo-connections Vulnerability Details CVEID:CVE-2018-16487 DESCRIPTION: A prototype pollution vulnerability was found in lodash 4.17.11 where the functions merge,...

Prototype Pollution loadash.pick Dependency Vulnerability in Jira Service Management Data Center and Server

This High severity Prototype Pollution vulnerability known as CVE-2020-8203 was introduced in 10.3.0 of Jira Service Management Data Center and Server. This vulnerability with a CVSS Score of 7.4 and a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H allows an unauthenticated attacker ...

EUVD-2025-201719

Malicious code in gs-uitk-lodash npm...

Malicious code in gs-uitk-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2de2e606bc9fde8de540caf63cbded837e1bbbd7bc6bd2d477e38dcf89a76f0b The package gs-uitk-lodash was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-192377 Malicious code in gs-uitk-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2de2e606bc9fde8de540caf63cbded837e1bbbd7bc6bd2d477e38dcf89a76f0b The package gs-uitk-lodash was found to contain malicious code. Source: ossf-package-analysis...

PT-2026-29328

Name of the Vulnerable Software and Affected Versions Lodash versions prior to 4.18.0 Description Lodash versions 4.17.23 and earlier are susceptible to prototype pollution through the .unset and .omit functions. The initial fix did not fully address the issue, as an attacker can bypass the check...

MAL-2025-191574 Malicious code in eslint-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64e5339ebcf037bec59b58b4622230d6f22619a009685877e469b566e883248a The package eslint-lodash was found to contain malicious code...

Malicious code in eslint-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64e5339ebcf037bec59b58b4622230d6f22619a009685877e469b566e883248a The package eslint-lodash was found to contain malicious code...

EUVD-2019-0225

Malware in sbrugna...

EUVD-2021-0912

Malware in sbrugna...

EUVD-2022-0424

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2018-3721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data MAID vulnerability via defaultsDeep, merge, and mergeWith functions, whic...

Linux Distros Unpatched Vulnerability : CVE-2018-16487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A prototype pollution vulnerability was found in lodash 4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying...

Linux Distros Unpatched Vulnerability : CVE-2020-28500

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions. CVE-2020-28500 Note...

Linux Distros Unpatched Vulnerability : CVE-2019-1010266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack...

Linux Distros Unpatched Vulnerability : CVE-2021-23337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. CVE-2021-23337 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2020-8203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20. CVE-2020-8203 Note that Nessus relies on the presence of the package as reported ...