🧰 lodash

The items that name it 6

• Your CVE is reachable. But is it exploitable?
  articleas classification.technologies2026-10-17
• Dependabot vs Renovate
  articleas affected products2026-09-14It is written here as lodash (disclosed vulnerabilities in every published release during a stretch of 2026, including the latest).

  disclosed vulnerabilities in every published release during a stretch of 2026, including the latest

• Software supply chain security requires decisions rather than defaults
  articleas affected products2026-08-26

  Disclosed arbitrary code injection vulnerability affecting every published version, tied to the _.template function

• Dependency Confusion: How Attackers Poison Your Build | Blog | Endor Labs
  articleas affected products2026-07-29

  typosquatted as 'lodahs' in the page's example

• The upgrade trap: when upgrading is the wrong answer to a CVE
  articleas affected products2026-07-22

  Had two disclosed vulnerabilities affecting every published version up to and including 4.17.23; npm audit reported no fix available since that was the latest version

• JFrog: Where CVE Severity Scores Go Wrong
  writeupas affected products2026-07-01

  JavaScript utility library; vulnerable defaultsDeep() function allows prototype pollution via attacker-supplied __proto__ properties.