836 matches found
PT-2026-93247
TuxCare rebuilt lodash to address 2 CVEs. Fixed in 4.17.11-tuxcare.2...
PT-2026-75468
TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.11-tuxcare.1...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Prototype Pollution
Summary Lodash is used by IBM Storage Fusion Data Foundation, which could cause Prototype Pollution CVE-2025-13465, CVE-2026-2950, CVE-2026-4800. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the .unset and...
Malicious code in @404c3s4r/lodash (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11434 Malicious code in @404c3s4r/lodash (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-54737
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...
CVE-2026-54737 @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...
PT-2026-66832
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...
Malicious code in lodash-ex (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18ddc129136b388cfe448e3253a312b7a54ddc90993e77f4e91fd859b08fbb47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview lodash-ex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
MAL-2026-11327 Malicious code in lodash-ex (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18ddc129136b388cfe448e3253a312b7a54ddc90993e77f4e91fd859b08fbb47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Security Bulletin: Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Data Synchronization App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash...
Oracle Primavera Unifier (July 2026 CPU)
The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Integration Lodash. Supported versions that are...
Vulnerabilities found in Oracle Communications
Oracle has identified vulnerabilities in its Communications products and underlying third-party software. There are a total of 213 vulnerabilities, of which 67 reside in Oracle products and 146 in third-party products that have already received updates. The most serious vulnerabilities, 12 in...
K000162352: Lodash vulnerability CVE-2026-4800
Security Advisory Description Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validation for the variable option in .template but did not apply the same validation to options.imports key names. Both paths flow into the same Function constructor sink. Whe...
lodash: lodash: Arbitrary code execution via untrusted input in template imports
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in .template but did not apply the same validation to options.imports key names. Both paths flow into the same Function constructor sink. Additionally, .template uses assignInWith to merge imports, whi...
Malicious Package
Overview @gocortexio/npmgremlinbox-typosquat-lodash is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...
MAL-2026-10856 Malicious code in @gocortexio/npmgremlinbox-typosquat-lodash (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fac92ee65337be0a32cfe771e1a471827b35d08304b02a76ae80b479fb7cac7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @gocortexio/npmgremlinbox-typosquat-lodash (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fac92ee65337be0a32cfe771e1a471827b35d08304b02a76ae80b479fb7cac7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...