CVE-2026-2950 (GCVE-0-2026-2950)

Vulnerability from cvelistv5 – Published: 2026-03-31 19:18 – Updated: 2026-04-01 13:43
VLAI
Title
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Summary
Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
Impacted products
Vendor Product Version
lodash lodash Affected: 4.17.23 , < 4.18.0 (semver)
Unaffected: 4.18.0 (semver)
Create a notification for this product.
lodash lodash-es Affected: 4.17.23 , < 4.18.0 (semver)
Unaffected: 4.18.0 (semver)
Create a notification for this product.
lodash lodash-amd Affected: 4.17.23 , < 4.18.0 (semver)
Unaffected: 4.18.0 (semver)
Create a notification for this product.
lodash lodash.unset Affected: 4.0.0 , < 4.18.0 (semver)
Unaffected: 4.18.0 (semver)
Create a notification for this product.
Credits
Haruna38 shpik-kr maru1009 ott3r07 zolbooo backuardo falsyvalues jonchurch jdalton UlisesGascon
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2950",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T13:43:14.280375Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T13:43:21.491Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/lodash",
          "product": "lodash",
          "vendor": "lodash",
          "versions": [
            {
              "lessThan": "4.18.0",
              "status": "affected",
              "version": "4.17.23",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.18.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/lodash-es",
          "product": "lodash-es",
          "vendor": "lodash",
          "versions": [
            {
              "lessThan": "4.18.0",
              "status": "affected",
              "version": "4.17.23",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.18.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/lodash-amd",
          "product": "lodash-amd",
          "vendor": "lodash",
          "versions": [
            {
              "lessThan": "4.18.0",
              "status": "affected",
              "version": "4.17.23",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.18.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/lodash.unset",
          "product": "lodash.unset",
          "vendor": "lodash",
          "versions": [
            {
              "lessThan": "4.18.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.18.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Haruna38"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "shpik-kr"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "maru1009"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "ott3r07"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "zolbooo"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "backuardo"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "falsyvalues"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "jonchurch"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "jdalton"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Impact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\n\nPatches:\n\nThis issue is patched in 4.18.0.\n\nWorkarounds:\n\nNone. Upgrade to the patched version."
            }
          ],
          "value": "Impact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\n\nPatches:\n\nThis issue is patched in 4.18.0.\n\nWorkarounds:\n\nNone. Upgrade to the patched version."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T19:18:35.796Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"
        }
      ],
      "title": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-2950",
    "datePublished": "2026-03-31T19:18:35.796Z",
    "dateReserved": "2026-02-21T20:04:35.087Z",
    "dateUpdated": "2026-04-01T13:43:21.491Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-2950",
      "date": "2026-07-27",
      "epss": "0.00317",
      "percentile": "0.24062"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-2950\",\"sourceIdentifier\":\"ce714d77-add3-4f53-aff5-83d477b104bb\",\"published\":\"2026-03-31T20:16:26.207\",\"lastModified\":\"2026-07-24T20:10:00.147\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Impact:\\n\\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\\n\\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\\n\\nPatches:\\n\\nThis issue is patched in 4.18.0.\\n\\nWorkarounds:\\n\\nNone. Upgrade to the patched version.\"},{\"lang\":\"es\",\"value\":\"Impacto:\\n\\nLas versiones de Lodash 4.17.23 y anteriores son vulnerables a la contaminaci\u00f3n de prototipos en las funciones _.unset y _.omit. La soluci\u00f3n para (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) solo protege contra miembros de clave de tipo cadena, por lo que un atacante puede eludir la verificaci\u00f3n pasando segmentos de ruta envueltos en arrays. Esto permite la eliminaci\u00f3n de propiedades de prototipos incorporados como Object.prototype, Number.prototype y String.prototype.\\n\\nEl problema permite la eliminaci\u00f3n de propiedades de prototipo, pero no permite sobrescribir su comportamiento original.\\n\\nParches:\\n\\nEste problema est\u00e1 parcheado en 4.18.0.\\n\\nSoluciones alternativas:\\n\\nNinguna. Actualice a la versi\u00f3n parcheada.\"}],\"affected\":[{\"source\":\"ce714d77-add3-4f53-aff5-83d477b104bb\",\"affectedData\":[{\"vendor\":\"lodash\",\"product\":\"lodash\",\"defaultStatus\":\"unaffected\",\"packageURL\":\"pkg:npm/lodash\",\"versions\":[{\"version\":\"4.17.23\",\"lessThan\":\"4.18.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.18.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"}]},{\"vendor\":\"lodash\",\"product\":\"lodash-es\",\"defaultStatus\":\"unaffected\",\"packageURL\":\"pkg:npm/lodash-es\",\"versions\":[{\"version\":\"4.17.23\",\"lessThan\":\"4.18.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.18.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"}]},{\"vendor\":\"lodash\",\"product\":\"lodash-amd\",\"defaultStatus\":\"unaffected\",\"packageURL\":\"pkg:npm/lodash-amd\",\"versions\":[{\"version\":\"4.17.23\",\"lessThan\":\"4.18.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.18.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"}]},{\"vendor\":\"lodash\",\"product\":\"lodash.unset\",\"defaultStatus\":\"unaffected\",\"packageURL\":\"pkg:npm/lodash.unset\",\"versions\":[{\"version\":\"4.0.0\",\"lessThan\":\"4.18.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.18.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ce714d77-add3-4f53-aff5-83d477b104bb\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-01T13:43:14.280375Z\",\"id\":\"CVE-2026-2950\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"ce714d77-add3-4f53-aff5-83d477b104bb\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1321\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.17.23\",\"matchCriteriaId\":\"0F9E287B-784B-472D-9FA2-1469E4C8A810\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lodash:lodash-amd:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.17.23\",\"matchCriteriaId\":\"3A1B5527-B25F-49B8-A289-E964EFFCF4E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lodash:lodash-es:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.17.23\",\"matchCriteriaId\":\"4C20325C-6B92-4775-89D7-2650F158B622\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lodash:lodash.unset:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"4.0.0\",\"matchCriteriaId\":\"43DC850D-9F26-4445-BAB1-9AF9BA37095C\"}]}]}],\"references\":[{\"url\":\"https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg\",\"source\":\"ce714d77-add3-4f53-aff5-83d477b104bb\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-03T14:59:20+00:00",
      "cve": "CVE-2026-2950",
      "id": "CVE-2026-2950",
      "initial_release_date": "2026-03-31T19:18:35.796000+00:00",
      "product_status:fixed": "12",
      "product_status:known_affected": "385",
      "product_status:known_not_affected": "6",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2950.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-2950\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-01T13:43:14.280375Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-01T13:43:18.193Z\"}}], \"cna\": {\"title\": \"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Haruna38\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"shpik-kr\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"maru1009\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"ott3r07\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"zolbooo\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"backuardo\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"falsyvalues\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"jonchurch\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"jdalton\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"UlisesGascon\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"lodash\", \"product\": \"lodash\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.17.23\", \"lessThan\": \"4.18.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.18.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:npm/lodash\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"lodash\", \"product\": \"lodash-es\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.17.23\", \"lessThan\": \"4.18.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.18.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:npm/lodash-es\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"lodash\", \"product\": \"lodash-amd\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.17.23\", \"lessThan\": \"4.18.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.18.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:npm/lodash-amd\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"lodash\", \"product\": \"lodash.unset\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.18.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.18.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:npm/lodash.unset\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg\"}], \"x_generator\": {\"engine\": \"cve-kit 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Impact:\\n\\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\\n\\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\\n\\nPatches:\\n\\nThis issue is patched in 4.18.0.\\n\\nWorkarounds:\\n\\nNone. Upgrade to the patched version.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Impact:\\n\\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\\n\\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\\n\\nPatches:\\n\\nThis issue is patched in 4.18.0.\\n\\nWorkarounds:\\n\\nNone. Upgrade to the patched version.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1321\", \"description\": \"CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"ce714d77-add3-4f53-aff5-83d477b104bb\", \"shortName\": \"openjs\", \"dateUpdated\": \"2026-03-31T19:18:35.796Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-2950\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-01T13:43:21.491Z\", \"dateReserved\": \"2026-02-21T20:04:35.087Z\", \"assignerOrgId\": \"ce714d77-add3-4f53-aff5-83d477b104bb\", \"datePublished\": \"2026-03-31T19:18:35.796Z\", \"assignerShortName\": \"openjs\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.