CVE-2018-16487, CVE-2019-10744, CVE-2020-28500 +4 more CVEs: lodash before 4.17.21 (exclusive), from 4.0.0 (inclusive), before 4.17.23 (exclusive), 4.0.0 to…

CVE-2018-16487, CVE-2019-10744, CVE-2020-28500, CVE-2020-8203, CVE-2021-23337, CVE-2025-13465, CVE-2026-4800 affects lodash.isequal. EPSS 0.01491 (percentile 0.73962), scored 24-Oct-2026. Fixed version: 4.5.0-tuxcare.9.

CVE-2018-16487

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

The source does not specify what an attacker can achieve.

CVE-2019-10744

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

The source does not specify what an attacker can achieve.

CVE-2020-28500

Affected technology

lodash · before 4.17.21 (exclusive)
lodash

banking corporate lending process management · 14.2.0
oracle

banking corporate lending process management · 14.3.0
oracle

banking corporate lending process management · 14.5.0
oracle

banking credit facilities process management · 14.2.0
oracle

banking credit facilities process management · 14.3.0
oracle

banking credit facilities process management · 14.5.0
oracle

banking extensibility workbench · 14.2.0
oracle

banking extensibility workbench · 14.3.0
oracle

banking extensibility workbench · 14.5.0
oracle

banking supply chain finance · 14.2.0
oracle

banking supply chain finance · 14.3.0
oracle

banking supply chain finance · 14.5.0
oracle

banking trade finance process management · 14.2.0
oracle

banking trade finance process management · 14.3.0
oracle

banking trade finance process management · 14.5.0
oracle

communications cloud native core policy · 1.11.0
oracle

communications design studio · 7.4.2
oracle

communications services gatekeeper · 7.0
oracle

communications session border controller · 8.4
oracle

communications session border controller · 9.0
oracle

enterprise communications broker · 3.2.0
oracle

enterprise communications broker · 3.3.0
oracle

financial services crime and compliance management studio · 8.0.8.2.0
oracle

financial services crime and compliance management studio · 8.0.8.3.0
oracle

health sciences data management workbench · 2.5.2.1
oracle

health sciences data management workbench · 3.0.0.0
oracle

jd edwards enterpriseone tools · before 9.2.6.1 (exclusive)
oracle

peoplesoft enterprise peopletools · 8.58
oracle

peoplesoft enterprise peopletools · 8.59
oracle

primavera gateway · from 17.12.0 (inclusive), through 17.12.11 (inclusive)
oracle

primavera gateway · from 18.8.0 (inclusive), through 18.8.12 (inclusive)
oracle

primavera gateway · from 19.12.0 (inclusive), through 19.12.11 (inclusive)
oracle

primavera gateway · from 20.12.0 (inclusive), through 20.12.7 (inclusive)
oracle

primavera unifier · from 17.7 (inclusive), through 17.12 (inclusive)
oracle

primavera unifier · 18.8
oracle

primavera unifier · 19.12
oracle

primavera unifier · 20.12
oracle

retail customer management and segmentation foundation · 19.0
oracle

sinec ins · before 1.0 (exclusive)
siemens

sinec ins · 1.0
siemens

sinec ins · 1.0 · update sp1
siemens

Lodash · versions prior to 4.17.21
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and integrity impact as none; availability impact as low. NVD’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and integrity impact as none; availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2020-8203

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

The source does not specify what an attacker can achieve.

CVE-2021-23337

Affected technology

lodash · before 4.17.21 (exclusive)
lodash

banking corporate lending process management · 14.2.0
oracle

banking corporate lending process management · 14.3.0
oracle

banking corporate lending process management · 14.5.0
oracle

banking credit facilities process management · 14.2.0
oracle

banking credit facilities process management · 14.3.0
oracle

banking credit facilities process management · 14.5.0
oracle

banking extensibility workbench · 14.2.0
oracle

banking extensibility workbench · 14.3.0
oracle

banking extensibility workbench · 14.5.0
oracle

banking supply chain finance · 14.2.0
oracle

banking supply chain finance · 14.3.0
oracle

banking supply chain finance · 14.5.0
oracle

banking trade finance process management · 14.2.0
oracle

banking trade finance process management · 14.3.0
oracle

banking trade finance process management · 14.5.0
oracle

communications cloud native core binding support function · 1.9.0
oracle

communications cloud native core policy · 1.11.0
oracle

communications design studio · 7.4.2.0.0
oracle

communications services gatekeeper · 7.0
oracle

communications session border controller · 8.4
oracle

communications session border controller · 9.0
oracle

enterprise communications broker · 3.2.0
oracle

enterprise communications broker · 3.3.0
oracle

financial services crime and compliance management studio · 8.0.8.2.0
oracle

financial services crime and compliance management studio · 8.0.8.3.0
oracle

health sciences data management workbench · 2.5.2.1
oracle

health sciences data management workbench · 3.0.0.0
oracle

jd edwards enterpriseone tools · before 9.2.6.1 (exclusive)
oracle

peoplesoft enterprise peopletools · 8.58
oracle

peoplesoft enterprise peopletools · 8.59
oracle

primavera gateway · from 17.12.0 (inclusive), through 17.12.11 (inclusive)
oracle

primavera gateway · from 18.8.0 (inclusive), through 18.8.12 (inclusive)
oracle

primavera gateway · from 19.12.0 (inclusive), through 19.12.11 (inclusive)
oracle

primavera gateway · from 20.12.0 (inclusive), through 20.12.7 (inclusive)
oracle

primavera unifier · from 17.7 (inclusive), through 17.12 (inclusive)
oracle

primavera unifier · 18.8
oracle

primavera unifier · 19.12
oracle

primavera unifier · 20.12
oracle

retail customer management and segmentation foundation · 19.0
oracle

active iq unified manager · Version not applicable in the source CPE
netapp

cloud manager · Version not applicable in the source CPE
netapp

system manager · 9.0
netapp

sinec ins · before 1.0 (exclusive)
siemens

sinec ins · 1.0
siemens

sinec ins · 1.0 · update sp1
siemens

Lodash · prior to 4.17.21
Vendor not specified by the source

Description’s affected range: versions prior to 4.17.21

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 7.2/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.2/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2025-13465

Affected technology

lodash · from 4.0.0 (inclusive), before 4.17.23 (exclusive)
lodash

lodash · 4.0.0 to before 4.17.23
Lodash

lodash-amd · 4.0.0 to before 4.17.23
Lodash

lodash-es · 4.0.0 to before 4.17.23
Lodash

lodash.unset · 4.0.0 to before 4.18.0
Lodash

lodash.omit · 4.0.0 to before 4.18.0
Lodash

Cryostat 4 on RHEL 9 · Exact affected versions not specified by the source
Red Hat

HawtIO HawtIO 4.4.0 · Exact affected versions not specified by the source
Red Hat

Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Exact affected versions not specified by the source
Red Hat

Red Hat Data Grid 8.6.0 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 10 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 10.0 Extended Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.6 Telecommunications Update Service · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.8 Telecommunications Update Service · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9.4 Extended Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9.6 Extended Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 · Exact affected versions not specified by the source
Red Hat

Streams for Apache Kafka 2.9.4 · Exact affected versions not specified by the source
Red Hat

Cluster Observability Operator 1.4.0 · Exact affected versions not specified by the source
Red Hat

multicluster engine for Kubernetes 2.1 · Exact affected versions not specified by the source
Red Hat

multicluster engine for Kubernetes 2.6 · Exact affected versions not specified by the source
Red Hat

multicluster engine for Kubernetes 2.7 · Exact affected versions not specified by the source
Red Hat

multicluster engine for Kubernetes 2.8 · Exact affected versions not specified by the source
Red Hat

multicluster engine for Kubernetes 2.9 · Exact affected versions not specified by the source
Red Hat

Network Observability (NETOBSERV) 1.11.0 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.11 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.12 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.13 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.14 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.15 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Security 4.8 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Security 4.9 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Security for Kubernetes 4.10 · Exact affected versions not specified by the source
Red Hat

Red Hat Ansible Automation Platform 2.5 · Exact affected versions not specified by the source
Red Hat

Red Hat Ansible Automation Platform 2.6 · Exact affected versions not specified by the source
Red Hat

Red Hat Ceph Storage 7.1 · Exact affected versions not specified by the source
Red Hat

Red Hat Developer Hub 1.8 · Exact affected versions not specified by the source
Red Hat

Red Hat Discovery 2 · Exact affected versions not specified by the source
Red Hat

Red Hat Edge Manager 1.0 · Exact affected versions not specified by the source
Red Hat

Red Hat Edge Manager 1.1 · Exact affected versions not specified by the source
Red Hat

Red Hat Migration Toolkit 1.8 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift AI 2.25 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift AI 3.3 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.12 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.13 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.14 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.15 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.16 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.17 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.18 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.19 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.20 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.21 · Exact affected versions not specified by the source
Red Hat

Red Hat Openshift Data Foundation 4.18 · Exact affected versions not specified by the source
Red Hat

Red Hat Openshift Data Foundation 4.19 · Exact affected versions not specified by the source
Red Hat

Red Hat Openshift Data Foundation 4.20 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Dev Spaces 3.27 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift GitOps 1.17 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift GitOps 1.18 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift GitOps 1.19 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Pipelines 1.15 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Pipelines 1.2 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Service Mesh 2.6 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Service Mesh 3.0 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Service Mesh 3.1 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Service Mesh 3.2 · Exact affected versions not specified by the source
Red Hat

Red Hat Quay 3.16 · Exact affected versions not specified by the source
Red Hat

Red Hat Satellite 6.18 · Exact affected versions not specified by the source
Red Hat

Red Hat Trusted Artifact Signer 1.2 · Exact affected versions not specified by the source
Red Hat

Red Hat Trusted Artifact Signer 1.3 · Exact affected versions not specified by the source
Red Hat

Confidential Compute Attestation · Exact affected versions not specified by the source
Red Hat

Gatekeeper 3 · Exact affected versions not specified by the source
Red Hat

Logging Subsystem for Red Hat OpenShift · Exact affected versions not specified by the source
Red Hat

Migration Toolkit for Applications 8 · Exact affected versions not specified by the source
Red Hat

Migration Toolkit for Virtualization · Exact affected versions not specified by the source
Red Hat

Multicluster Engine for Kubernetes · Exact affected versions not specified by the source
Red Hat

Node HealthCheck Operator · Exact affected versions not specified by the source
Red Hat

OpenShift Lightspeed · Exact affected versions not specified by the source
Red Hat

OpenShift Pipelines · Exact affected versions not specified by the source
Red Hat

OpenShift Service Mesh 2 · Exact affected versions not specified by the source
Red Hat

OpenShift Service Mesh 3 · Exact affected versions not specified by the source
Red Hat

Red Hat 3scale API Management Platform 2 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Security 4 · Exact affected versions not specified by the source
Red Hat

Red Hat Ansible Automation Platform 2 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Apicurio Registry 2 · Exact affected versions not specified by the source
Red Hat

Red Hat build of OptaPlanner 8 · Exact affected versions not specified by the source
Red Hat

Red Hat Ceph Storage 4 · Exact affected versions not specified by the source
Red Hat

Red Hat Ceph Storage 5 · Exact affected versions not specified by the source
Red Hat

Red Hat Ceph Storage 6 · Exact affected versions not specified by the source
Red Hat

Red Hat Ceph Storage 8 · Exact affected versions not specified by the source
Red Hat

Red Hat Connectivity Link 1 · Exact affected versions not specified by the source
Red Hat

Red Hat Directory Server 11 · Exact affected versions not specified by the source
Red Hat

Red Hat Directory Server 12 · Exact affected versions not specified by the source
Red Hat

Red Hat Directory Server 13 · Exact affected versions not specified by the source
Red Hat

Red Hat Edge Manager preview · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 7 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux AI (RHEL AI) 3 · Exact affected versions not specified by the source
Red Hat

Red Hat Fuse 7 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 7 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 8 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform Expansion Pack · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift AI (RHOAI) · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Dev Spaces · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift distributed tracing 3 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift GitOps · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Virtualization 4 · Exact affected versions not specified by the source
Red Hat

Red Hat Process Automation 7 · Exact affected versions not specified by the source
Red Hat

Red Hat Quay 3 · Exact affected versions not specified by the source
Red Hat

Red Hat Satellite 6 · Exact affected versions not specified by the source
Red Hat

Red Hat Single Sign-On 7 · Exact affected versions not specified by the source
Red Hat

Red Hat Trusted Profile Analyzer · Exact affected versions not specified by the source
Red Hat

streams for Apache Kafka 3 · Exact affected versions not specified by the source
Red Hat

RUGGEDCOM RST2428P · 0 to before V4.0
Siemens

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. Source advisory’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as none; integrity and availability impact as low.

CVE-2026-4800

Affected technology

lodash · from 4.0.0 (inclusive), before 4.18.0 (exclusive)
lodash

lodash-amd · from 4.0.0 (inclusive), before 4.18.0 (exclusive)
lodash

lodash-es · from 4.0.0 (inclusive), before 4.18.0 (exclusive)
lodash

lodash.template · from 4.0.0 (inclusive), before 4.18.0 (exclusive)
lodash

lodash · 4.0.0 to before 4.18.1
lodash

lodash-es · 4.0.0 to before 4.18.1
lodash

lodash-amd · 4.0.0 to before 4.18.1
lodash

lodash.template · 4.0.0 to before 4.18.1
lodash

Cryostat 4 on RHEL 9 · Exact affected versions not specified by the source
Red Hat

Red Hat Ansible Automation Platform 2.5 for RHEL 8 · Exact affected versions not specified by the source
Red Hat

Red Hat Ansible Automation Platform 2.5 for RHEL 9 · Exact affected versions not specified by the source
Red Hat

Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Exact affected versions not specified by the source
Red Hat

Red Hat Data Grid 8.6.1 · Exact affected versions not specified by the source
Red Hat