CVE catalog
CVE-2025-13465
Lodash vulnerabilities
- Severity
- High · CVSS 8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.82% · Oct 25, 2026
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-lodash | sid | 4.18.1+dfsg1-2 | fixed |
| Debian | node-lodash | forky | 4.18.1+dfsg1-2 | fixed |
| Debian | node-lodash | trixie | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 | fixed |
| Debian | node-lodash | bookworm | 4.17.21+dfsg+~cs8.31.198.20210220-9 | vulnerable |
| Debian | node-lodash | bookworm-security | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 | fixed |
| Ubuntu | node-lodash | noble | Not reported | vulnerable |
| Ubuntu | node-lodash | noble | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | fixed |
| Ubuntu | libjs-lodash | noble | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | fixed |
| Ubuntu | node-lodash-packages | noble | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | fixed |
| Npm | lodash | Not reported | 4.17.23 | fixed |
| Npm | lodash-es | Not reported | 4.17.23 | fixed |
| Npm | lodash-amd | Not reported | 4.17.23 | fixed |
| Npm | lodash.unset | Not reported | Not reported | unknown |
| Cpe | lodash | Not reported | 4.17.23 | fixed |
| Npm | lodash | Not reported | 4.18.0 | fixed |
| Npm | lodash-es | Not reported | 4.18.0 | fixed |
| Npm | lodash-amd | Not reported | 4.18.0 | fixed |
| Npm | lodash.unset | Not reported | 4.18.0 | fixed |
| Ubuntu | node-lodash | pro | 4.17.21+dfsg+~cs8.31.198.20210220-9 | vulnerable |
| Ubuntu | node-lodash | pro | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | fixed |
| Ubuntu | node-lodash | 25.10 | 4.17.21+dfsg+~cs8.31.198.20210220-9 | vulnerable |
| Ubuntu | node-lodash | 25.10 | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 | fixed |
| Suse | cockpit | linux enterprise server 16.0 | 364-160000.1.1 | fixed |
| Suse | cockpit-machines | linux enterprise server 16.0 | 354-160000.1.1 | fixed |
| Suse | cockpit-packages | linux enterprise server 16.0 | 5-160000.1.1 | fixed |
| Suse | cockpit-podman | linux enterprise server 16.0 | 128-160000.1.1 | fixed |
| Suse | cockpit-repos | linux enterprise server 16.0 | 4.8-160000.1.1 | fixed |
| Suse | cockpit-subscriptions | linux enterprise server 16.0 | 16.2-160000.1.1 | fixed |
| Suse | cockpit | linux enterprise server for sap applications 16.0 | 364-160000.1.1 | fixed |
| Suse | cockpit-machines | linux enterprise server for sap applications 16.0 | 354-160000.1.1 | fixed |
| Suse | cockpit-packages | linux enterprise server for sap applications 16.0 | 5-160000.1.1 | fixed |
| Suse | cockpit-podman | linux enterprise server for sap applications 16.0 | 128-160000.1.1 | fixed |
| Suse | cockpit-repos | linux enterprise server for sap applications 16.0 | 4.8-160000.1.1 | fixed |
| Suse | cockpit-subscriptions | linux enterprise server for sap applications 16.0 | 16.2-160000.1.1 | fixed |
| Opensuse | cockpit | leap 16.0 | 364-160000.1.1 | fixed |
| Opensuse | cockpit-machines | leap 16.0 | 354-160000.1.1 | fixed |
| Opensuse | cockpit-packages | leap 16.0 | 5-160000.1.1 | fixed |
| Opensuse | cockpit-podman | leap 16.0 | 128-160000.1.1 | fixed |
| Opensuse | cockpit-repos | leap 16.0 | 4.8-160000.1.1 | fixed |
| Opensuse | cockpit-subscriptions | leap 16.0 | 16.2-160000.1.1 | fixed |
| Suse | cockpit | linux micro 6.2 | 364-160000.1.1 | fixed |
| Suse | cockpit-machines | linux micro 6.2 | 354-160000.1.1 | fixed |
| Suse | cockpit-podman | linux micro 6.2 | 128-160000.1.1 | fixed |
| Suse | cockpit-repos | linux micro 6.2 | 4.8-160000.1.1 | fixed |
| Suse | cockpit-subscriptions | linux micro 6.2 | 16.2-160000.1.1 | fixed |
| Suse | golang-github-lusitaniae-apache_exporter | multi linux manager tools sle-15 | 1.0.10-150002.3.6.1 | fixed |
| Suse | golang-github-prometheus-prometheus | multi linux manager tools sle-15 | 3.5.0-150002.3.8.1 | fixed |
| Suse | grafana | multi linux manager tools sle-15 | 11.6.14+security01-150002.4.14.1 | fixed |
| Suse | prometheus-blackbox_exporter | multi linux manager tools sle-15 | 0.26.0-150002.3.6.1 | fixed |
| Suse | spacecmd | multi linux manager tools sle-15 | 5.1.13-150002.3.9.3 | fixed |
| Suse | uyuni-tools | multi linux manager tools sle-15 | 5.1.26-150002.3.12.1 | fixed |
| Suse | prometheus-blackbox_exporter | multi linux manager tools sle-micro-5 | 0.26.0-150002.3.6.1 | fixed |
| Suse | uyuni-tools | multi linux manager tools sle-micro-5 | 5.1.26-150002.3.12.1 | fixed |
| Opensuse | cockpit-repos | leap 16.0 | 4.7-160000.1.1 | fixed |
| Opensuse | cockpit | leap 16.0 | 354-160000.1.1 | fixed |
| Opensuse | cockpit-machines | leap 16.0 | 346-160000.1.1 | fixed |
| Opensuse | cockpit-packages | leap 16.0 | 3-160000.3.1 | fixed |
| Opensuse | cockpit-subscriptions | tumbleweed | 14.4-2.1 | fixed |
| Opensuse | cockpit-packages | tumbleweed | 4.1-2.1 | fixed |
| Opensuse | cockpit-machines | tumbleweed | 346-2.1 | fixed |
| Opensuse | cockpit-repos | tumbleweed | 4.7-2.1 | fixed |
| Opensuse | golang-github-prometheus-prometheus | tumbleweed | 3.9.1-2.1 | fixed |
| Opensuse | cockpit-podman | leap 16.0 | 117-160000.1.1 | fixed |
| Suse | cockpit-subscriptions | linux enterprise server 16.0 | 12.1-160000.2.1 | fixed |
| Suse | cockpit-subscriptions | linux enterprise server for sap applications 16.0 | 12.1-160000.2.1 | fixed |
| Suse | cockpit | linux enterprise server 16.0 | 340-160000.4.1 | fixed |
| Suse | cockpit | linux enterprise server for sap applications 16.0 | 340-160000.4.1 | fixed |
| Suse | cockpit-machines | linux micro 6.0 | 305-2.1 | fixed |
| Suse | cockpit-podman | linux micro 6.2 | 117-160000.1.1 | fixed |
| Suse | cockpit | linux micro 6.1 | 322-slfo.1.1_2.1 | fixed |
| Suse | cockpit-repos | linux micro 6.2 | 4.7-160000.1.1 | fixed |
| Suse | cockpit | linux micro 6.2 | 354-160000.1.1 | fixed |
| Suse | cockpit-machines | linux micro 6.2 | 346-160000.1.1 | fixed |
| Suse | cockpit-podman | linux micro 6.1 | 91-slfo.1.1_3.1 | fixed |
| Suse | cockpit | linux micro 6.0 | 309-8.1 | fixed |
| Suse | cockpit-repos | linux enterprise server 16.0 | 4.7-160000.1.1 | fixed |
| Suse | cockpit-repos | linux enterprise server for sap applications 16.0 | 4.7-160000.1.1 | fixed |
| Suse | cockpit | linux enterprise server 16.0 | 354-160000.1.1 | fixed |
| Suse | cockpit-machines | linux enterprise server 16.0 | 346-160000.1.1 | fixed |
| Suse | cockpit | linux enterprise server for sap applications 16.0 | 354-160000.1.1 | fixed |
| Suse | cockpit-machines | linux enterprise server for sap applications 16.0 | 346-160000.1.1 | fixed |
| Suse | cockpit-packages | linux enterprise server 16.0 | 3-160000.3.1 | fixed |
| Suse | cockpit-packages | linux enterprise server for sap applications 16.0 | 3-160000.3.1 | fixed |
| Suse | cockpit | linux micro 6.2 | 340-160000.4.1 | fixed |
| Suse | cockpit-subscriptions | linux micro 6.2 | 12.1-160000.2.1 | fixed |
| Suse | cockpit-podman | linux enterprise micro 5.2 | 33-150300.6.6.1 | fixed |
| Suse | cockpit-machines | linux micro 6.1 | 316-slfo.1.1_2.1 | fixed |
| Opensuse | cockpit-subscriptions | leap 16.0 | 12.1-160000.2.1 | fixed |
| Opensuse | cockpit-podman | tumbleweed | 119.1-2.1 | fixed |
| Opensuse | cockpit | leap 16.0 | 340-160000.4.1 | fixed |
| Opensuse | cockpit | tumbleweed | 354-3.1 | fixed |
| Suse | cockpit | linux enterprise micro 5.2 | 251.3-150300.6.6.1 | fixed |
| Suse | cockpit-machines | linux enterprise micro 5.2 | 249.1-150300.5.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-lodash | source | sid | 4.17.21+dfsg+~cs8.31.198.20210220-10 | not yet assigned | Not reported | [1126265] |
| Debian | node-lodash | source | forky | 4.17.21+dfsg+~cs8.31.198.20210220-10 | not yet assigned | Not reported | [1126265] |
| Debian | node-lodash | source | trixie | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 | not yet assigned | Not reported | [1126265] |
| Debian | node-lodash | source | bookworm | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 | not yet assigned | Not reported | [1126265] |
| Ubuntu | node-lodash | deb | noble | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | Not reported | Not reported | Not reported |
| Ubuntu | libjs-lodash | deb | noble | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | Not reported | Not reported | Not reported |
| Ubuntu | node-lodash-packages | deb | noble | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | Not reported | Not reported | Not reported |
| Npm | lodash | npm | Not reported | 4.17.23 | Not reported | GHSA-XXJR-MMJV-4GPG | Not reported |
| Npm | lodash-es | npm | Not reported | 4.17.23 | Not reported | GHSA-XXJR-MMJV-4GPG | Not reported |
| Npm | lodash-amd | npm | Not reported | 4.17.23 | Not reported | GHSA-XXJR-MMJV-4GPG | Not reported |
| Cpe | lodash | cpe | Not reported | 4.17.23 | Not reported | NVD-CVE-2025-13465 | Not reported |
| Npm | lodash | npm | Not reported | 4.18.0 | Not reported | GHSA-F23M-R3PF-42RH | Not reported |
| Npm | lodash-es | npm | Not reported | 4.18.0 | Not reported | GHSA-F23M-R3PF-42RH | Not reported |
| Npm | lodash-amd | npm | Not reported | 4.18.0 | Not reported | GHSA-F23M-R3PF-42RH | Not reported |
| Npm | lodash.unset | npm | Not reported | 4.18.0 | Not reported | GHSA-F23M-R3PF-42RH | Not reported |
| Ubuntu | node-lodash | deb | pro | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | Not reported | UBUNTU-CVE-2025-13465 | Not reported |
| Ubuntu | node-lodash | deb | 25.10 | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 | Not reported | UBUNTU-CVE-2025-13465 | Not reported |
| Suse | cockpit | rpm | linux enterprise server 16.0 | 364-160000.1.1 | Not reported | SUSE-SU-2026:22837-1 | Not reported |
| Suse | cockpit-machines | rpm | linux enterprise server 16.0 | 354-160000.1.1 | Not reported | SUSE-SU-2026:22837-1 | Not reported |
| Suse | cockpit-packages | rpm | linux enterprise server 16.0 | 5-160000.1.1 | Not reported | SUSE-SU-2026:22837-1 | Not reported |
| Suse | cockpit-podman | rpm | linux enterprise server 16.0 | 128-160000.1.1 | Not reported | SUSE-SU-2026:22837-1 | Not reported |
| Suse | cockpit-repos | rpm | linux enterprise server 16.0 | 4.8-160000.1.1 | Not reported | SUSE-SU-2026:22837-1 | Not reported |
| Suse | cockpit-subscriptions | rpm | linux enterprise server 16.0 | 16.2-160000.1.1 | Not reported | SUSE-SU-2026:22837-1 | Not reported |
| Suse | cockpit | rpm | linux enterprise server for sap applications 16.0 | 364-160000.1.1 | Not reported | SUSE-SU-2026:22837-1 | Not reported |
| Suse | cockpit-machines | rpm | linux enterprise server for sap applications 16.0 | 354-160000.1.1 | Not reported | SUSE-SU-2026:22837-1 | Not reported |
| Suse | cockpit-packages | rpm | linux enterprise server for sap applications 16.0 | 5-160000.1.1 | Not reported | SUSE-SU-2026:22837-1 | Not reported |
| Suse | cockpit-podman | rpm | linux enterprise server for sap applications 16.0 | 128-160000.1.1 | Not reported | SUSE-SU-2026:22837-1 | Not reported |
| Suse | cockpit-repos | rpm | linux enterprise server for sap applications 16.0 | 4.8-160000.1.1 | Not reported | SUSE-SU-2026:22837-1 | Not reported |
| Suse | cockpit-subscriptions | rpm | linux enterprise server for sap applications 16.0 | 16.2-160000.1.1 | Not reported | SUSE-SU-2026:22837-1 | Not reported |
| Opensuse | cockpit | rpm | leap 16.0 | 364-160000.1.1 | Not reported | OPENSUSE-SU-2026:21399-1 | Not reported |
| Opensuse | cockpit-machines | rpm | leap 16.0 | 354-160000.1.1 | Not reported | OPENSUSE-SU-2026:21399-1 | Not reported |
| Opensuse | cockpit-packages | rpm | leap 16.0 | 5-160000.1.1 | Not reported | OPENSUSE-SU-2026:21399-1 | Not reported |
| Opensuse | cockpit-podman | rpm | leap 16.0 | 128-160000.1.1 | Not reported | OPENSUSE-SU-2026:21399-1 | Not reported |
| Opensuse | cockpit-repos | rpm | leap 16.0 | 4.8-160000.1.1 | Not reported | OPENSUSE-SU-2026:21399-1 | Not reported |
| Opensuse | cockpit-subscriptions | rpm | leap 16.0 | 16.2-160000.1.1 | Not reported | OPENSUSE-SU-2026:21399-1 | Not reported |
| Suse | cockpit | rpm | linux micro 6.2 | 364-160000.1.1 | Not reported | SUSE-SU-2026:22770-1 | Not reported |
| Suse | cockpit-machines | rpm | linux micro 6.2 | 354-160000.1.1 | Not reported | SUSE-SU-2026:22770-1 | Not reported |
| Suse | cockpit-podman | rpm | linux micro 6.2 | 128-160000.1.1 | Not reported | SUSE-SU-2026:22770-1 | Not reported |
| Suse | cockpit-repos | rpm | linux micro 6.2 | 4.8-160000.1.1 | Not reported | SUSE-SU-2026:22770-1 | Not reported |
| Suse | cockpit-subscriptions | rpm | linux micro 6.2 | 16.2-160000.1.1 | Not reported | SUSE-SU-2026:22770-1 | Not reported |
| Suse | golang-github-lusitaniae-apache_exporter | rpm | multi linux manager tools sle-15 | 1.0.10-150002.3.6.1 | Not reported | SUSE-SU-2026:1524-1 | Not reported |
| Suse | golang-github-prometheus-prometheus | rpm | multi linux manager tools sle-15 | 3.5.0-150002.3.8.1 | Not reported | SUSE-SU-2026:1524-1 | Not reported |
| Suse | grafana | rpm | multi linux manager tools sle-15 | 11.6.14+security01-150002.4.14.1 | Not reported | SUSE-SU-2026:1524-1 | Not reported |
| Suse | prometheus-blackbox_exporter | rpm | multi linux manager tools sle-15 | 0.26.0-150002.3.6.1 | Not reported | SUSE-SU-2026:1524-1 | Not reported |
| Suse | spacecmd | rpm | multi linux manager tools sle-15 | 5.1.13-150002.3.9.3 | Not reported | SUSE-SU-2026:1524-1 | Not reported |
| Suse | uyuni-tools | rpm | multi linux manager tools sle-15 | 5.1.26-150002.3.12.1 | Not reported | SUSE-SU-2026:1524-1 | Not reported |
| Suse | prometheus-blackbox_exporter | rpm | multi linux manager tools sle-micro-5 | 0.26.0-150002.3.6.1 | Not reported | SUSE-SU-2026:1524-1 | Not reported |
| Suse | uyuni-tools | rpm | multi linux manager tools sle-micro-5 | 5.1.26-150002.3.12.1 | Not reported | SUSE-SU-2026:1524-1 | Not reported |
| Opensuse | cockpit-repos | rpm | leap 16.0 | 4.7-160000.1.1 | Not reported | OPENSUSE-SU-2026:20251-1 | Not reported |
| Opensuse | cockpit | rpm | leap 16.0 | 354-160000.1.1 | Not reported | OPENSUSE-SU-2026:20244-1 | Not reported |
| Opensuse | cockpit-machines | rpm | leap 16.0 | 346-160000.1.1 | Not reported | OPENSUSE-SU-2026:20244-1 | Not reported |
| Opensuse | cockpit-packages | rpm | leap 16.0 | 3-160000.3.1 | Not reported | OPENSUSE-SU-2026:20185-1 | Not reported |
| Opensuse | cockpit-subscriptions | rpm | tumbleweed | 14.4-2.1 | Not reported | OPENSUSE-SU-2026:10150-1 | Not reported |
| Opensuse | cockpit-packages | rpm | tumbleweed | 4.1-2.1 | Not reported | OPENSUSE-SU-2026:10148-1 | Not reported |
| Opensuse | cockpit-machines | rpm | tumbleweed | 346-2.1 | Not reported | OPENSUSE-SU-2026:10147-1 | Not reported |
| Opensuse | cockpit-repos | rpm | tumbleweed | 4.7-2.1 | Not reported | OPENSUSE-SU-2026:10149-1 | Not reported |
| Opensuse | golang-github-prometheus-prometheus | rpm | tumbleweed | 3.9.1-2.1 | Not reported | OPENSUSE-SU-2026:10124-1 | Not reported |
| Opensuse | cockpit-podman | rpm | leap 16.0 | 117-160000.1.1 | Not reported | OPENSUSE-SU-2026:20336-1 | Not reported |
| Suse | cockpit-subscriptions | rpm | linux enterprise server 16.0 | 12.1-160000.2.1 | Not reported | SUSE-SU-2026:20336-1 | Not reported |
| Suse | cockpit-subscriptions | rpm | linux enterprise server for sap applications 16.0 | 12.1-160000.2.1 | Not reported | SUSE-SU-2026:20336-1 | Not reported |
| Suse | cockpit | rpm | linux enterprise server 16.0 | 340-160000.4.1 | Not reported | SUSE-SU-2026:20337-1 | Not reported |
| Suse | cockpit | rpm | linux enterprise server for sap applications 16.0 | 340-160000.4.1 | Not reported | SUSE-SU-2026:20337-1 | Not reported |
| Suse | cockpit-machines | rpm | linux micro 6.0 | 305-2.1 | Not reported | SUSE-SU-2026:20695-1 | Not reported |
| Suse | cockpit-podman | rpm | linux micro 6.2 | 117-160000.1.1 | Not reported | SUSE-SU-2026:20688-1 | Not reported |
| Suse | cockpit | rpm | linux micro 6.1 | 322-slfo.1.1_2.1 | Not reported | SUSE-SU-2026:20653-1 | Not reported |
| Suse | cockpit-repos | rpm | linux micro 6.2 | 4.7-160000.1.1 | Not reported | SUSE-SU-2026:20540-1 | Not reported |
| Suse | cockpit | rpm | linux micro 6.2 | 354-160000.1.1 | Not reported | SUSE-SU-2026:20538-1 | Not reported |
| Suse | cockpit-machines | rpm | linux micro 6.2 | 346-160000.1.1 | Not reported | SUSE-SU-2026:20538-1 | Not reported |
| Suse | cockpit-podman | rpm | linux micro 6.1 | 91-slfo.1.1_3.1 | Not reported | SUSE-SU-2026:20494-1 | Not reported |
| Suse | cockpit | rpm | linux micro 6.0 | 309-8.1 | Not reported | SUSE-SU-2026:20454-1 | Not reported |
| Suse | cockpit-repos | rpm | linux enterprise server 16.0 | 4.7-160000.1.1 | Not reported | SUSE-SU-2026:20580-1 | Not reported |
| Suse | cockpit-repos | rpm | linux enterprise server for sap applications 16.0 | 4.7-160000.1.1 | Not reported | SUSE-SU-2026:20580-1 | Not reported |
| Suse | cockpit | rpm | linux enterprise server 16.0 | 354-160000.1.1 | Not reported | SUSE-SU-2026:20576-1 | Not reported |
| Suse | cockpit-machines | rpm | linux enterprise server 16.0 | 346-160000.1.1 | Not reported | SUSE-SU-2026:20576-1 | Not reported |
| Suse | cockpit | rpm | linux enterprise server for sap applications 16.0 | 354-160000.1.1 | Not reported | SUSE-SU-2026:20576-1 | Not reported |
| Suse | cockpit-machines | rpm | linux enterprise server for sap applications 16.0 | 346-160000.1.1 | Not reported | SUSE-SU-2026:20576-1 | Not reported |
| Suse | cockpit-packages | rpm | linux enterprise server 16.0 | 3-160000.3.1 | Not reported | SUSE-SU-2026:20338-1 | Not reported |
| Suse | cockpit-packages | rpm | linux enterprise server for sap applications 16.0 | 3-160000.3.1 | Not reported | SUSE-SU-2026:20338-1 | Not reported |
| Suse | cockpit | rpm | linux micro 6.2 | 340-160000.4.1 | Not reported | SUSE-SU-2026:20237-1 | Not reported |
| Suse | cockpit-subscriptions | rpm | linux micro 6.2 | 12.1-160000.2.1 | Not reported | SUSE-SU-2026:20236-1 | Not reported |
| Suse | cockpit-podman | rpm | linux enterprise micro 5.2 | 33-150300.6.6.1 | Not reported | SUSE-SU-2026:0379-1 | Not reported |
| Suse | cockpit-machines | rpm | linux micro 6.1 | 316-slfo.1.1_2.1 | Not reported | SUSE-SU-2026:20650-1 | Not reported |
| Opensuse | cockpit-subscriptions | rpm | leap 16.0 | 12.1-160000.2.1 | Not reported | OPENSUSE-SU-2026:20181-1 | Not reported |
| Opensuse | cockpit-podman | rpm | tumbleweed | 119.1-2.1 | Not reported | OPENSUSE-SU-2026:10155-1 | Not reported |
| Opensuse | cockpit | rpm | leap 16.0 | 340-160000.4.1 | Not reported | OPENSUSE-SU-2026:20182-1 | Not reported |
| Opensuse | cockpit | rpm | tumbleweed | 354-3.1 | Not reported | OPENSUSE-SU-2026:10154-1 | Not reported |
| Suse | cockpit | rpm | linux enterprise micro 5.2 | 251.3-150300.6.6.1 | Not reported | SUSE-SU-2026:0397-1 | Not reported |
| Suse | cockpit-machines | rpm | linux enterprise micro 5.2 | 249.1-150300.5.3.1 | Not reported | SUSE-SU-2026:0396-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libjs-lodash]Affected
Source package: [node-lodash]
Details (2)
4.17.21+dfsg+~cs8.31.198.20210220-9· all · bookwormAffected · Fixed:
4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1usn · node-lodash · debian · bookworm
4.17.21+dfsg+~cs8.31.198.20210220-9· all · bookwormAffected · Fixed:
4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1usn · node-lodash · debian · bookworm
- [node-lodash]Affected
Details (2)
4.17.21+dfsg+~cs8.31.198.20210220-9· all · bookwormAffected · Fixed:
4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1usn · node-lodash · debian · bookworm
4.17.21+dfsg+~cs8.31.198.20210220-9· all · bookwormAffected · Fixed:
4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1usn · node-lodash · debian · bookworm
- [node-lodash-packages]Affected
Source package: [node-lodash]
Details (2)
4.17.21+dfsg+~cs8.31.198.20210220-9· all · bookwormAffected · Fixed:
4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1usn · node-lodash · debian · bookworm
4.17.21+dfsg+~cs8.31.198.20210220-9· all · bookwormAffected · Fixed:
4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1usn · node-lodash · debian · bookworm
[openSUSE Tumbleweed]
- [cockpit-bridge]Unknown
Source package: [cockpit]
Details (1)
365-1.1· noarch · tumbleweedUnknown · Fixed:
354-3.1Version impact unknown
usn · cockpit · opensuse · tumbleweed
- [cockpit-devel]Unknown
Source package: [cockpit]
Details (1)
365-1.1· x86_64 · tumbleweedUnknown · Fixed:
354-3.1Version impact unknown
usn · cockpit · opensuse · tumbleweed
- [cockpit-doc]Unknown
Source package: [cockpit]
Details (1)
365-1.1· noarch · tumbleweedUnknown · Fixed:
354-3.1Version impact unknown
usn · cockpit · opensuse · tumbleweed
- [cockpit-firewalld]Unknown
Source package: [cockpit]
Details (1)
365-1.1· noarch · tumbleweedUnknown · Fixed:
354-3.1Version impact unknown
usn · cockpit · opensuse · tumbleweed
- [cockpit-kdump]Unknown
Source package: [cockpit]
Details (1)
365-1.1· noarch · tumbleweedUnknown · Fixed:
354-3.1Version impact unknown
usn · cockpit · opensuse · tumbleweed
- [cockpit-networkmanager]Unknown
Source package: [cockpit]
Details (1)
365-1.1· noarch · tumbleweedUnknown · Fixed:
354-3.1Version impact unknown
usn · cockpit · opensuse · tumbleweed
- [cockpit-packagekit]Unknown
Source package: [cockpit]
Details (1)
365-1.1· noarch · tumbleweedUnknown · Fixed:
354-3.1Version impact unknown
usn · cockpit · opensuse · tumbleweed
- [cockpit-selinux]Unknown
Source package: [cockpit]
Details (1)
365-1.1· noarch · tumbleweedUnknown · Fixed:
354-3.1Version impact unknown
usn · cockpit · opensuse · tumbleweed
- [cockpit-storaged]Unknown
Source package: [cockpit]
Details (1)
365-1.1· noarch · tumbleweedUnknown · Fixed:
354-3.1Version impact unknown
usn · cockpit · opensuse · tumbleweed
- [cockpit-system]Unknown
Source package: [cockpit]
Details (1)
365-1.1· noarch · tumbleweedUnknown · Fixed:
354-3.1Version impact unknown
usn · cockpit · opensuse · tumbleweed
- [cockpit-ws]Unknown
Source package: [cockpit]
Details (1)
365-1.1· x86_64 · tumbleweedUnknown · Fixed:
354-3.1Version impact unknown
usn · cockpit · opensuse · tumbleweed
- [cockpit-ws-selinux]Unknown
Source package: [cockpit]
Details (1)
365-1.1· x86_64 · tumbleweedUnknown · Fixed:
354-3.1Version impact unknown
usn · cockpit · opensuse · tumbleweed
- [cockpit]Fixed
Source package: [cockpit]
Details (1)
365-1.1· x86_64 · tumbleweedFixed · Fixed:
354-3.1usn · cockpit · opensuse · tumbleweed
- [cockpit-machines]Fixed
Source package: [cockpit-machines]
Details (1)
355-1.1· noarch · tumbleweedFixed · Fixed:
346-2.1usn · cockpit-machines · opensuse · tumbleweed
- [cockpit-packages]Fixed
Source package: [cockpit-packages]
Details (1)
5-1.1· noarch · tumbleweedFixed · Fixed:
4.1-2.1usn · cockpit-packages · opensuse · tumbleweed
- [cockpit-podman]Fixed
Source package: [cockpit-podman]
Details (1)
129-1.1· noarch · tumbleweedFixed · Fixed:
119.1-2.1usn · cockpit-podman · opensuse · tumbleweed
- [cockpit-repos]Fixed
Source package: [cockpit-repos]
Details (1)
4.9-1.1· noarch · tumbleweedFixed · Fixed:
4.7-2.1usn · cockpit-repos · opensuse · tumbleweed
Observed:
References
- [https://cert-portal.siemens.com/productcert/csaf/ssa-253495.json]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21399-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2025-13465]
- [https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh]
- [https://osv.dev/vulnerability/GHSA-xxjr-mmjv-4gpg]
- [https://osv.dev/vulnerability/SUSE-SU-2026:0379-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:0396-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:0397-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:1524-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20236-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20237-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20336-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20337-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20338-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20454-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20494-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20538-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20540-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20576-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20580-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20650-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20653-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20688-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20695-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:22770-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:22837-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2025-13465]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10124-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10147-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10148-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10149-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10150-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10154-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10155-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20181-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20182-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20185-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20244-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20251-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20336-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21399-1]
- [https://security-tracker.debian.org/tracker/CVE-2025-13465]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json]
- [https://ubuntu.com/security/notices/USN-8411-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2260.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]