[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-2950":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T11:19:25.255Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":93,"aliases":94,"duplicate_of":9,"upstream":96,"downstream":97,"duplicates":110,"related":111,"reserved_at":9,"published_at":114,"modified_at":115,"state":116,"summary":117,"references_raw":126,"kevs":149,"epss":150,"epss_history":153,"metrics":430,"affected":443},"CVE-2026-2950","Impact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\n\nPatches:\n\nThis issue is patched in 4.18.0.\n\nWorkarounds:\n\nNone. Upgrade to the patched version.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-1321","Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.","weakness","Incomplete","Variant",[19,67,89],{"id":20,"name":21,"techniques":22},"CAPEC-1","Accessing Functionality Not Properly Constrained by ACLs",[23],{"id":24,"name":25,"tactics":26,"countermeasures":42},"T1574.010","Services File Permissions Weakness",[27,30,33,36,39],{"id":28,"name":29},"TA0110","Persistence",{"id":31,"name":32},"TA0111","Privilege Escalation",{"id":34,"name":35},"TA0030","Defense Evasion",{"id":37,"name":38},"TA0005","Stealth",{"id":40,"name":41},"TA0104","Execution",[43,48,52,57,62],{"id":44,"name":45,"tactic":46},"D3-SWI","Software Inventory",{"name":47},"Model",{"id":49,"name":50,"tactic":51},"D3-AVE","Asset Vulnerability Enumeration",{"name":47},{"id":53,"name":54,"tactic":55},"D3-SBV","Service Binary Verification",{"name":56},"Detect",{"id":58,"name":59,"tactic":60},"D3-SU","Software Update",{"name":61},"Harden",{"id":63,"name":64,"tactic":65},"D3-RS","Restore Software",{"name":66},"Restore",{"id":68,"name":69,"techniques":70},"CAPEC-180","Exploiting Incorrectly Configured Access Control Security Levels",[71],{"id":24,"name":25,"tactics":72,"countermeasures":78},[73,74,75,76,77],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},{"id":37,"name":38},{"id":40,"name":41},[79,81,83,85,87],{"id":44,"name":45,"tactic":80},{"name":47},{"id":49,"name":50,"tactic":82},{"name":47},{"id":53,"name":54,"tactic":84},{"name":56},{"id":58,"name":59,"tactic":86},{"name":61},{"id":63,"name":64,"tactic":88},{"name":66},{"id":90,"name":91,"techniques":92},"CAPEC-77","Manipulating User-Controlled Variables",[],[],[95],"GHSA-f23m-r3pf-42rh",[],[98,100,102,104,106,108],{"_key":99},"UBUNTU-CVE-2026-2950",{"_key":101},"USN-8411-1",{"_key":103},"DEBIAN-CVE-2026-2950",{"_key":105},"RHSA-2026:7378",{"_key":107},"RHSA-2026:7655",{"_key":109},"RHSA-2026:9455",[],[112],{"_key":113},"CGA-W8P3-8Q8V-32X5","2026-03-31T19:18:35.796Z","2026-04-01T13:43:21.491Z","Analyzed",{"cisa_kev":118,"cisa_ransomware":118,"cisa_vendor":9,"epss_severity":119,"epss_score":120,"severity":121,"severity_score":122,"severity_version":123,"severity_source":124,"severity_vector":125,"severity_status":116},false,"low",0.00317,"medium",6.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",[127,135,139,144],{"url":128,"sources":129,"tags":132},"https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",[124,130,131],"nvd","osv_npm",[133,134],"WEB","Vendor Advisory",{"url":136,"sources":137,"tags":138},"https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh",[131],[133],{"url":140,"sources":141,"tags":142},"https://nvd.nist.gov/vuln/detail/CVE-2026-2950",[131],[143],"Advisory",{"url":145,"sources":146,"tags":147},"https://github.com/lodash/lodash",[131],[148],"PACKAGE",[],{"date":151,"score":120,"percentile":152},"2026-07-05",0.23594,[154,158,161,164,167,170,174,177,181,184,187,190,193,196,199,202,205,208,210,213,216,220,223,226,229,232,235,238,241,244,247,250,254,257,260,263,266,269,272,275,278,281,284,287,290,293,296,299,302,305,308,311,314,317,320,323,326,329,332,335,338,341,344,347,350,353,356,359,363,366,369,372,375,378,381,384,388,391,394,397,400,403,406,409,412,415,418,421,424,427],{"date":155,"score":156,"percentile":157},"2026-04-01",0.00042,0.12755,{"date":159,"score":156,"percentile":160},"2026-04-02",0.12856,{"date":162,"score":156,"percentile":163},"2026-04-03",0.12875,{"date":165,"score":156,"percentile":166},"2026-04-04",0.12908,{"date":168,"score":156,"percentile":169},"2026-04-05",0.12887,{"date":171,"score":172,"percentile":173},"2026-04-06",0.00055,0.17228,{"date":175,"score":172,"percentile":176},"2026-04-07",0.17215,{"date":178,"score":179,"percentile":180},"2026-04-08",0.00071,0.21756,{"date":182,"score":179,"percentile":183},"2026-04-09",0.21814,{"date":185,"score":179,"percentile":186},"2026-04-10",0.21832,{"date":188,"score":179,"percentile":189},"2026-04-11",0.21824,{"date":191,"score":179,"percentile":192},"2026-04-12",0.21785,{"date":194,"score":179,"percentile":195},"2026-04-13",0.21728,{"date":197,"score":179,"percentile":198},"2026-04-14",0.21692,{"date":200,"score":179,"percentile":201},"2026-04-15",0.21739,{"date":203,"score":179,"percentile":204},"2026-04-16",0.21727,{"date":206,"score":179,"percentile":207},"2026-04-17",0.21734,{"date":209,"score":179,"percentile":207},"2026-04-18",{"date":211,"score":179,"percentile":212},"2026-04-19",0.21667,{"date":214,"score":179,"percentile":215},"2026-04-20",0.21637,{"date":217,"score":218,"percentile":219},"2026-04-21",0.00023,0.06255,{"date":221,"score":218,"percentile":222},"2026-04-22",0.06261,{"date":224,"score":218,"percentile":225},"2026-04-23",0.0628,{"date":227,"score":218,"percentile":228},"2026-04-24",0.06274,{"date":230,"score":218,"percentile":231},"2026-04-25",0.06416,{"date":233,"score":218,"percentile":234},"2026-04-26",0.0641,{"date":236,"score":218,"percentile":237},"2026-04-27",0.064,{"date":239,"score":218,"percentile":240},"2026-04-28",0.06402,{"date":242,"score":218,"percentile":243},"2026-04-29",0.06422,{"date":245,"score":218,"percentile":246},"2026-04-30",0.06428,{"date":248,"score":218,"percentile":249},"2026-05-01",0.06424,{"date":251,"score":252,"percentile":253},"2026-05-02",0.00025,0.0705,{"date":255,"score":252,"percentile":256},"2026-05-03",0.07038,{"date":258,"score":252,"percentile":259},"2026-05-04",0.0702,{"date":261,"score":252,"percentile":262},"2026-05-05",0.07031,{"date":264,"score":252,"percentile":265},"2026-05-06",0.07058,{"date":267,"score":252,"percentile":268},"2026-05-07",0.07179,{"date":270,"score":252,"percentile":271},"2026-05-08",0.07217,{"date":273,"score":252,"percentile":274},"2026-05-09",0.0727,{"date":276,"score":252,"percentile":277},"2026-05-10",0.07269,{"date":279,"score":252,"percentile":280},"2026-05-11",0.07249,{"date":282,"score":252,"percentile":283},"2026-05-12",0.07265,{"date":285,"score":252,"percentile":286},"2026-05-13",0.07268,{"date":288,"score":252,"percentile":289},"2026-05-14",0.07294,{"date":291,"score":252,"percentile":292},"2026-05-15",0.07295,{"date":294,"score":252,"percentile":295},"2026-05-16",0.0731,{"date":297,"score":252,"percentile":298},"2026-05-17",0.07306,{"date":300,"score":252,"percentile":301},"2026-05-18",0.07258,{"date":303,"score":252,"percentile":304},"2026-05-19",0.07228,{"date":306,"score":252,"percentile":307},"2026-05-20",0.07186,{"date":309,"score":252,"percentile":310},"2026-05-21",0.07185,{"date":312,"score":252,"percentile":313},"2026-05-22",0.07471,{"date":315,"score":252,"percentile":316},"2026-05-23",0.07479,{"date":318,"score":252,"percentile":319},"2026-05-24",0.0748,{"date":321,"score":252,"percentile":322},"2026-05-25",0.07465,{"date":324,"score":252,"percentile":325},"2026-05-26",0.07449,{"date":327,"score":252,"percentile":328},"2026-05-27",0.07496,{"date":330,"score":252,"percentile":331},"2026-05-28",0.07645,{"date":333,"score":252,"percentile":334},"2026-05-29",0.07665,{"date":336,"score":252,"percentile":337},"2026-05-30",0.07659,{"date":339,"score":252,"percentile":340},"2026-05-31",0.07643,{"date":342,"score":252,"percentile":343},"2026-06-01",0.07615,{"date":345,"score":252,"percentile":346},"2026-06-02",0.07566,{"date":348,"score":252,"percentile":349},"2026-06-03",0.07511,{"date":351,"score":252,"percentile":352},"2026-06-04",0.07525,{"date":354,"score":252,"percentile":355},"2026-06-05",0.07562,{"date":357,"score":252,"percentile":358},"2026-06-06",0.0757,{"date":360,"score":361,"percentile":362},"2026-06-07",0.00026,0.07936,{"date":364,"score":361,"percentile":365},"2026-06-08",0.07885,{"date":367,"score":361,"percentile":368},"2026-06-09",0.07903,{"date":370,"score":361,"percentile":371},"2026-06-10",0.07924,{"date":373,"score":361,"percentile":374},"2026-06-11",0.07945,{"date":376,"score":361,"percentile":377},"2026-06-12",0.0798,{"date":379,"score":361,"percentile":380},"2026-06-13",0.07977,{"date":382,"score":361,"percentile":383},"2026-06-14",0.07972,{"date":385,"score":386,"percentile":387},"2026-06-15",0.00297,0.21146,{"date":389,"score":386,"percentile":390},"2026-06-16",0.21174,{"date":392,"score":386,"percentile":393},"2026-06-17",0.21176,{"date":395,"score":386,"percentile":396},"2026-06-18",0.21193,{"date":398,"score":386,"percentile":399},"2026-06-19",0.21183,{"date":401,"score":386,"percentile":402},"2026-06-20",0.21172,{"date":404,"score":386,"percentile":405},"2026-06-21",0.21159,{"date":407,"score":386,"percentile":408},"2026-06-22",0.21129,{"date":410,"score":386,"percentile":411},"2026-06-23",0.21198,{"date":413,"score":386,"percentile":414},"2026-06-24",0.21227,{"date":416,"score":386,"percentile":417},"2026-06-25",0.21316,{"date":419,"score":386,"percentile":420},"2026-06-26",0.2135,{"date":422,"score":120,"percentile":423},"2026-06-27",0.23511,{"date":425,"score":120,"percentile":426},"2026-06-28",0.2347,{"date":428,"score":120,"percentile":429},"2026-06-29",0.23469,[431,436,441],{"source":124,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":432,"cvss_v4_0":9},{"baseScore":122,"baseSeverity":433,"vectorString":125,"impactScore":434,"exploitabilityScore":435},"MEDIUM",4.2,10,{"source":130,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":437,"cvss_v4_0":9},{"baseScore":438,"baseSeverity":433,"vectorString":439,"impactScore":440,"exploitabilityScore":435},5.3,"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",2.3,{"source":131,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":442,"cvss_v4_0":9},{"baseScore":122,"baseSeverity":9,"vectorString":125,"impactScore":434,"exploitabilityScore":435},[444,460,465,470,477,484,487,490],{"ecosystem":9,"name":445,"vendor":446,"product":446,"cpe_part":447,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":448},"Lodash","lodash","a",[449,456],{"version":450,"is_range":451,"range_type":124,"version_start":452,"version_start_type":453,"version_end":454,"version_end_type":455,"fixed_in":9},">= 4.17.23, \u003C 4.18.0",true,"4.17.23","including","4.18.0","excluding",{"version":457,"is_range":451,"range_type":458,"version_start":459,"version_start_type":453,"version_end":452,"version_end_type":455,"fixed_in":9},"gte4.0.0_lt4.17.23","cpe","4.0.0",{"ecosystem":9,"name":461,"vendor":446,"product":461,"cpe_part":447,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":462},"lodash-amd",[463,464],{"version":450,"is_range":451,"range_type":124,"version_start":452,"version_start_type":453,"version_end":454,"version_end_type":455,"fixed_in":9},{"version":457,"is_range":451,"range_type":458,"version_start":459,"version_start_type":453,"version_end":452,"version_end_type":455,"fixed_in":9},{"ecosystem":9,"name":466,"vendor":446,"product":466,"cpe_part":447,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":467},"lodash-es",[468,469],{"version":450,"is_range":451,"range_type":124,"version_start":452,"version_start_type":453,"version_end":454,"version_end_type":455,"fixed_in":9},{"version":457,"is_range":451,"range_type":458,"version_start":459,"version_start_type":453,"version_end":452,"version_end_type":455,"fixed_in":9},{"ecosystem":9,"name":471,"vendor":446,"product":471,"cpe_part":447,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":472},"lodash.unset",[473,475],{"version":474,"is_range":451,"range_type":124,"version_start":459,"version_start_type":453,"version_end":454,"version_end_type":455,"fixed_in":9},">= 4.0.0, \u003C 4.18.0",{"version":476,"is_range":451,"range_type":458,"version_start":459,"version_start_type":453,"version_end":9,"version_end_type":9,"fixed_in":9},"gte4.0.0",{"ecosystem":478,"name":446,"vendor":478,"product":446,"cpe_part":9,"purl_type":479,"purl_namespace":9,"purl_name":446,"source":9,"versions":480},"Npm","npm",[481],{"version":482,"is_range":451,"range_type":483,"version_start":9,"version_start_type":9,"version_end":454,"version_end_type":455,"fixed_in":9},"lt4_18_0","semver",{"ecosystem":478,"name":461,"vendor":478,"product":461,"cpe_part":9,"purl_type":479,"purl_namespace":9,"purl_name":461,"source":9,"versions":485},[486],{"version":482,"is_range":451,"range_type":483,"version_start":9,"version_start_type":9,"version_end":454,"version_end_type":455,"fixed_in":9},{"ecosystem":478,"name":466,"vendor":478,"product":466,"cpe_part":9,"purl_type":479,"purl_namespace":9,"purl_name":466,"source":9,"versions":488},[489],{"version":482,"is_range":451,"range_type":483,"version_start":9,"version_start_type":9,"version_end":454,"version_end_type":455,"fixed_in":9},{"ecosystem":478,"name":471,"vendor":478,"product":471,"cpe_part":9,"purl_type":479,"purl_namespace":9,"purl_name":471,"source":9,"versions":491},[492],{"version":493,"is_range":451,"range_type":483,"version_start":459,"version_start_type":453,"version_end":454,"version_end_type":455,"fixed_in":9},"gte4_0_0_lt4_18_0"]