CVE-2023-22621-POC

CVE-2023-22621-POC CVE-2023-22621: SSTI to RCE by Exploiting Email Templates affecting Strapi Versions return strapi.config.get'plugin.email'; ; const send = async options = return strapi.plugin'email'.provider.sendoptions; ; / fill subject, text and html using lodash template @param object...

Lodash Template - Server-Side Template Injection (RCE)

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. id: CVE-2021-23337 info: name: Lodash Template - Server-Side Template Injection RCE author: DhiyaneshDk severity: high description: | Lodash versions prior to 4.17.21 are vulnerable to Command Injectio...

nextjs-lodash-cve-2025-13465-repro

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. T...

CVE-2026-4800-POC

CVE-2026-4800-POC Security Advisory https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc POC root@kitploit: const = require'lodash'; Object.prototype.imports = 'x=process.getBuiltinModule"childprocess".execSync"curl https://example.com"':undefined .template'', ; Flow Using a...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0)

Summary Vulnerabilities exists in IBM Cloud Pak for Data System CPDS 1.0 addressed in 11.3.1.2-IF1 Vulnerability Details CVEID:CVE-2025-38527 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifsoplockbreak A race condition can...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to deletion of properties (CVE-2025-13465)

Summary Undici is used by IBM Storage Fusion Data Foundation in components odf-console, noobaa-core. This bulletin identifies the steps to take to address the vulnerability in IBM Storage Fusion Data Foundation. CVE-2025-13465 Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash version...

CLSA-2026-1785468076 TuxCare security update for lodash-es (7 CVEs)

TuxCare rebuilt lodash-es to address 7 CVEs. Fixed in 4.17.11-tuxcare.1...

CLSA-2026-1785468082 TuxCare security update for lodash-es (6 CVEs)

TuxCare rebuilt lodash-es to address 6 CVEs. Fixed in 4.17.15-tuxcare.1...

CLSA-2026-1785291646 TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.5-tuxcare.3...

CLSA-2026-1784596286 TuxCare security update for lodash (5 CVEs)

TuxCare rebuilt lodash to address 5 CVEs. Fixed in 4.17.4-tuxcare.3...

CLSA-2026-1784509823 TuxCare security update for lodash (3 CVEs)

TuxCare rebuilt lodash to address 3 CVEs. Fixed in 4.17.4-tuxcare.2...

CLSA-2026-1784250515 TuxCare security update for lodash (2 CVEs)

TuxCare rebuilt lodash to address 2 CVEs. Fixed in 4.17.5-tuxcare.1...

CLSA-2026-1784250520 TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.11-tuxcare.1...

CLSA-2026-1777336764 TuxCare security update for lodash (6 CVEs)

TuxCare rebuilt lodash to address 6 CVEs. Fixed in 4.18.1-tuxcare.1...

CLSA-2026-1775262602 TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 2.4.2-tuxcare.1...

CLSA-2026-1775262601 TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 1.3.1-tuxcare.1...

CLSA-2026-1775003201 TuxCare security update for lodash.set (1 CVE)

TuxCare rebuilt lodash.set to address 1 CVE. Fixed in 4.3.2-tuxcare.1...

CLSA-2026-1773188140 TuxCare security update for lodash (5 CVEs)

TuxCare rebuilt lodash to address 5 CVEs. Fixed in 3.10.1-tuxcare.2...

Malicious code in @404c3s4r/lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11434 Malicious code in @404c3s4r/lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...