CLSA-2026-1785468082 TuxCare security update for lodash-es (6 CVEs)

TuxCare rebuilt lodash-es to address 6 CVEs. Fixed in 4.17.15-tuxcare.1...

CLSA-2026-1785468076 TuxCare security update for lodash-es (7 CVEs)

TuxCare rebuilt lodash-es to address 7 CVEs. Fixed in 4.17.11-tuxcare.1...

ROOT-APP-NPM-CVE-2025-13465 CVE-2025-13465 in @rootio/lodash - Patched by Root

Root has patched CVE-2025-13465 in the @rootio/lodash package for Root:npm. Multiple fixed versions available...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in lodash and lodash-es (CVE-2026-2950, CVE-2026-4800)

Summary Multiple vulnerabilities in the lodash and lodash-es utility libraries CVE-2026-2950, CVE-2026-4800 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the components to version 4.18.0. Vulnerability Details CVEID:CVE-2026-2950 DESCRIPTION: Impact: Lodash versions...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Lodash and Lodash-es (CVE-2025-13465)

Summary A prototype pollution vulnerability in the Lodash and Lodash-es libraries CVE-2025-13465 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading to version 4.18.0. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash versions 4.0.0 through 4.17.22 are...

Security Bulletin: Carbon Charts lodash-es Security Vulnerabilities

Summary Carbon Charts versions prior to 1.27.8 include lodash-es version 4.17.23, which contains two security vulnerabilities: a prototype pollution vulnerability CVE-2026-2950, CVSS 5.3 in the .unset and .omit functions that allows deletion of properties from built-in prototypes, and a critical...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection due the improper validation of options.imports key names in .template. An attacker can execute arbitrary code at template compilation time by injecting malicious expressions. If Object.prototype has been pollute...

Code Injection

Overview Affected versions of this package are vulnerable to Code Injection due the improper validation of options.variable key names in .template. An attacker can execute arbitrary code at template compilation time by injecting malicious expressions. If Object.prototype has been polluted,...

@across-ui/example (>=0.0.1-alpha.4, <=0.0.4-alpha.5), @admui/grid (>=0.1.10, <=0.3.1) +809 more potentially affected by CVE-2020-8203 via lodash-es (>=3.10.1, <=4.17.15)

lodash-es NPM version =3.10.1, =0.0.1-alpha.4, =0.1.10, =0.0.1, =0.0.2, =3.2.1, =3.2.1, =3.2.1, =0.0.1, =3.2.1, =3.2.1, =0.3.14, =0.4.63, =0.4.64 and more Source cves: CVE-2020-8203 Source advisory: OSV:GHSA-P6MC-M468-83GW...