LO
Vendor
lodash
21
CVEs
0
On KEV
0
New 30D
Products
LO9.8
lodash
lodash
10 CVEs0 on KEV0 new
LO9.8
lodash-amd
lodash
3 CVEs0 on KEV0 new
LO9.8
lodash-es
lodash
3 CVEs0 on KEV0 new
LO5.3
lodash.omit
lodash
2 CVEs0 on KEV0 new
LO5.3
lodash.unset
lodash
2 CVEs0 on KEV0 new
LO9.8
lodash.template
lodash
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-4800 | LO lodash lodash | 9.8 | Mar 31 | lodash vulnerable to Code Injection via `_.template` imports key names |
| CVE-2026-2950 | LO lodash lodash | 5.3 | Mar 31 | lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` |
| CVE-2025-13465 | LO lodash.omit Lodash | 5.3 | Jan 21 | Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions |
| CVE-2021-23337 | LO Lodash Lodash | 7.2 | Feb 15 | Command Injection |
| CVE-2020-28500 | LO Lodash Lodash | 5.3 | Feb 15 | Regular Expression Denial of Service (ReDoS) |
| CVE-2020-8203 | LO Lodash Lodash | 7.4 | Jul 15 | Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20 |
| CVE-2019-10744 | LO Lodash Lodash | 9.1 | Jul 26 | Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution |
| CVE-2019-1010266 | LO Lodash Lodash | 6.5 | Jul 17 | lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption |
| CVE-2018-16487 | LO Lodash Lodash | 5.6 | Feb 1 | A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of… |
| CVE-2018-3721 | LO Lodash Lodash | 6.5 | Jun 7 | lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a… |