CVE-2023-22621-POC

CVE-2023-22621-POC CVE-2023-22621: SSTI a RCE explotando plantillas de correo electrónico que afecta a las versiones de Strapi return strapi.config.get'plugin.email'; ; const send = async options = return strapi.plugin'email'.provider.sendoptions; ; / fill subject, text and html using lodash...

nextjs-lodash-cve-2025-13465-repro

هذا مشروع Next.js تم إنشاؤه باستخدام create-next-app. البدء أولاً، قم بتشغيل خادم التطوير: root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev افتح http://localhost:3000 في متصفحك لرؤية النتيجة. يمكنك البدء في تعديل الصفحة عن طريق تعديل app/page.tsx. يتم تحديث الصفحة تلقائيًا أثناء تعدي...

Lodash Template - Server-Side Template Injection (RCE)

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. id: CVE-2021-23337 info: name: Lodash Template - Server-Side Template Injection RCE author: DhiyaneshDk severity: high description: | Lodash versions prior to 4.17.21 are vulnerable to Command Injectio...

CLSA-2026-1785468082 TuxCare security update for lodash-es (6 CVEs)

TuxCare rebuilt lodash-es to address 6 CVEs. Fixed in 4.17.15-tuxcare.1...

CLSA-2026-1785468076 TuxCare security update for lodash-es (7 CVEs)

TuxCare rebuilt lodash-es to address 7 CVEs. Fixed in 4.17.11-tuxcare.1...

CLSA-2026-1784596286 TuxCare security update for lodash (5 CVEs)

TuxCare rebuilt lodash to address 5 CVEs. Fixed in 4.17.4-tuxcare.3...

CLSA-2026-1784250515 TuxCare security update for lodash (2 CVEs)

TuxCare rebuilt lodash to address 2 CVEs. Fixed in 4.17.5-tuxcare.1...

CLSA-2026-1784250520 TuxCare security update for lodash (7 CVEs)

TuxCare rebuilt lodash to address 7 CVEs. Fixed in 4.17.11-tuxcare.1...

CLSA-2026-1777336764 TuxCare security update for lodash (8 CVEs)

TuxCare rebuilt lodash to address 8 CVEs. Fixed in 4.18.1-tuxcare.1...

CLSA-2026-1775262602 TuxCare security update for lodash (5 CVEs)

TuxCare rebuilt lodash to address 5 CVEs. Fixed in 2.4.2-tuxcare.1...

CLSA-2026-1775003201 TuxCare security update for lodash.set (5 CVEs)

TuxCare rebuilt lodash.set to address 5 CVEs. Fixed in 4.3.2-tuxcare.1...

CLSA-2026-1773188140 TuxCare security update for lodash (5 CVEs)

TuxCare rebuilt lodash to address 5 CVEs. Fixed in 3.10.1-tuxcare.2...

MAL-2026-11434 Malicious code in @404c3s4r/lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-54737

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

CVE-2026-54737 @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

PT-2026-66832

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

Security Bulletin: Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Data Synchronization App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash...

Oracle Primavera Unifier (July 2026 CPU)

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Integration Lodash. Supported versions that are...

Vulnerabilities found in Oracle Communications

Oracle has identified vulnerabilities in its Communications products and underlying third-party software. There are a total of 213 vulnerabilities, of which 67 reside in Oracle products and 146 in third-party products that have already received updates. The most serious vulnerabilities, 12 in...

K000162352: Lodash vulnerability CVE-2026-4800

Security Advisory Description Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validation for the variable option in .template but did not apply the same validation to options.imports key names. Both paths flow into the same Function constructor sink. Whe...