{"id":"GHSA-29mw-wpgm-hmr9","revision":null,"records":[{"revision":"d36176a8cbdd4711be2e58bd8f96fc0c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2020-28500","aliases":[],"title":"Regular Expression Denial of Service (ReDoS)","description":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","state":0,"publishedAt":"2021-02-15T11:10:16.225+00:00","modifiedAt":"2026-10-08T21:13:56.095+00:00","affected":[{"ecosystem":"Vendor product","name":"Lodash","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Lodash\",\n                    \"vendor\": \"n/a\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"versions prior to 4.17.21\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","score":5.3,"severity":"MEDIUM"}],"references":["https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://github.com/lodash/lodash/pull/5065","https://www.oracle.com//security-alerts/cpujul2021.html","https://security.netapp.com/advisory/ntap-20210312-0006/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2020-28500","license":"CVE Program Terms of Use","key":"cve-program:CVE-2020-28500","identifiers":["CVE-2020-28500"]},"retained":false,"historicalAffected":[]},{"revision":"1edfcba54dba4868bd70cb55b484926a","observedAt":"2026-11-09T20:13:34.511+00:00","statement":{"source":"euvd","id":"EUVD-2022-0424","aliases":["CVE-2020-28500","GHSA-29mw-wpgm-hmr9"],"title":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","description":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","score":5.3,"severity":null}],"references":["https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://github.com/lodash/lodash/pull/5065","https://www.oracle.com//security-alerts/cpujul2021.html","https://security.netapp.com/advisory/ntap-20210312-0006/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0424","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Feb 15, 2021, 11:10:16 AM","dateUpdated":"Oct 8, 2026, 9:13:56 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2022-1375","title":"JFrog Artifactory: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2013-4517","CVE-2013-7285","CVE-2014-0107","CVE-2014-0114","CVE-2014-3577","CVE-2014-3623","CVE-2015-0227","CVE-2015-2575","CVE-2015-3253","CVE-2015-4852","CVE-2015-7940","CVE-2016-10750","CVE-2016-3092","CVE-2016-3674","CVE-2016-6501","CVE-2016-8735","CVE-2016-8745","CVE-2017-1000487","CVE-2017-15095","CVE-2017-17485","CVE-2017-18214","CVE-2017-18640","CVE-2017-7525","CVE-2017-7657","CVE-2017-7957","CVE-2017-9506","CVE-2018-1000206","CVE-2018-9116","CVE-2019-10219","CVE-2019-12402","CVE-2019-17359","CVE-2019-17571","CVE-2019-20104","CVE-2020-11996","CVE-2020-13934","CVE-2020-13935","CVE-2020-13949","CVE-2020-14340","CVE-2020-15586","CVE-2020-1745","CVE-2020-17521","CVE-2020-25649","CVE-2020-28500","CVE-2020-29582","CVE-2020-36518","CVE-2020-7226","CVE-2020-7692","CVE-2020-8203","CVE-2021-13936","CVE-2021-21290","CVE-2021-22060","CVE-2021-22112","CVE-2021-22119","CVE-2021-22147","CVE-2021-22148","CVE-2021-22149","CVE-2021-22573","CVE-2021-23337","CVE-2021-25122","CVE-2021-26291","CVE-2021-27568","CVE-2021-29505","CVE-2021-30129","CVE-2021-33037","CVE-2021-35550","CVE-2021-35556","CVE-2021-35560","CVE-2021-35561","CVE-2021-35564","CVE-2021-35565","CVE-2021-35567","CVE-2021-35578","CVE-2021-35586","CVE-2021-35588","CVE-2021-35603","CVE-2021-36374","CVE-2021-3765","CVE-2021-3807","CVE-2021-38561","CVE-2021-3859","CVE-2021-41090","CVE-2021-41091","CVE-2021-42340","CVE-2021-42550","CVE-2021-43797","CVE-2022-0536","CVE-2022-22963","CVE-2022-23632","CVE-2022-23648","CVE-2022-23806","CVE-2022-24769","CVE-2022-24823","CVE-2022-27191","CVE-2022-29153","CVE-2022-32212","CVE-2022-32213","CVE-2022-32214","CVE-2022-32215","CVE-2022-32223"]},{"id":"RHSA-2021:3459","title":"Red Hat Security Advisory: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.8]","vulnerabilityIds":["CVE-2020-28500","CVE-2021-23337"]},{"id":"ICSA-22-258-05","title":"Siemens SINEC INS","vulnerabilityIds":["CVE-2020-7793","CVE-2020-12762","CVE-2020-28168","CVE-2020-28500","CVE-2021-3749","CVE-2021-4160","CVE-2021-23337","CVE-2021-23839","CVE-2021-23841","CVE-2021-25217","CVE-2021-25220","CVE-2022-0155","CVE-2022-0235","CVE-2022-0396"]},{"id":"WID-SEC-W-2023-0857","title":"IBM QRadar SIEM: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2020-15168","CVE-2020-24025","CVE-2020-28469","CVE-2020-28498","CVE-2020-28500","CVE-2020-7793","CVE-2021-23337","CVE-2021-27292","CVE-2021-29060","CVE-2021-32803","CVE-2021-32804","CVE-2021-33502","CVE-2021-33623","CVE-2021-37701","CVE-2021-37712","CVE-2021-37713","CVE-2021-3807"]},{"id":"RHSA-2021:2438","title":"Red Hat Security Advisory: OpenShift Container Platform 4.8.2 bug fix and security update","vulnerabilityIds":["CVE-2016-2183","CVE-2020-7774","CVE-2020-15106","CVE-2020-15112","CVE-2020-15113","CVE-2020-15114","CVE-2020-15136","CVE-2020-26160","CVE-2020-28469","CVE-2020-28500","CVE-2020-28852","CVE-2021-3114","CVE-2021-3121","CVE-2021-20206","CVE-2021-20218","CVE-2021-20291","CVE-2021-22133","CVE-2021-23337","CVE-2021-23362","CVE-2021-23368","CVE-2021-23382","CVE-2021-26539","CVE-2021-26540","CVE-2021-27292","CVE-2021-28092","CVE-2021-29059","CVE-2021-29622","CVE-2021-33194"]},{"id":"RHSA-2021:2179","title":"Red Hat Security Advisory: RHV Manager security update (ovirt-engine) [ovirt-4.4.6]","vulnerabilityIds":["CVE-2020-28500","CVE-2021-23337"]},{"id":"RHSA-2021:3016","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.3","vulnerabilityIds":["CVE-2020-28469","CVE-2020-28500","CVE-2020-28851","CVE-2020-28852","CVE-2021-3377","CVE-2021-21272","CVE-2021-21309","CVE-2021-21321","CVE-2021-21322","CVE-2021-23337","CVE-2021-23343","CVE-2021-23346","CVE-2021-23362","CVE-2021-23364","CVE-2021-23368","CVE-2021-23369","CVE-2021-23382","CVE-2021-23383","CVE-2021-23839","CVE-2021-23840","CVE-2021-23841","CVE-2021-27292","CVE-2021-27358","CVE-2021-28092","CVE-2021-28918","CVE-2021-29418","CVE-2021-29477","CVE-2021-29478","CVE-2021-29482","CVE-2021-33502","CVE-2021-33623"]},{"id":"WID-SEC-W-2023-3025","title":"IBM InfoSphere Information Server: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2023-46174","CVE-2023-43804","CVE-2023-43642","CVE-2023-43021","CVE-2023-43015","CVE-2023-42022","CVE-2023-42019","CVE-2023-42009","CVE-2023-40699","CVE-2023-39410","CVE-2023-38268","CVE-2023-34462","CVE-2022-25883","CVE-2021-23337","CVE-2020-8203","CVE-2020-28500"]},{"id":"WID-SEC-W-2022-1384","title":"Red Hat Virtualization: Mehrere Schwachstellen ermöglichen Denial of Service","vulnerabilityIds":["CVE-2020-28500","CVE-2021-23337"]},{"id":"SSA-637483","title":"SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2","vulnerabilityIds":["CVE-2020-7793","CVE-2020-12762","CVE-2020-28168","CVE-2020-28500","CVE-2021-3749","CVE-2021-4160","CVE-2021-23337","CVE-2021-23839","CVE-2021-23841","CVE-2021-25217","CVE-2021-25220","CVE-2022-0155","CVE-2022-0235","CVE-2022-0396"]},{"id":"RHSA-2022:6429","title":"Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.4 security and bug fix update","vulnerabilityIds":["CVE-2020-28500","CVE-2021-23337","CVE-2022-0512","CVE-2022-0639","CVE-2022-0686","CVE-2022-0691","CVE-2022-1650","CVE-2022-30631"]},{"id":"RHSA-2021:2543","title":"Red Hat Security Advisory: Red Hat OpenShift Jaeger 1.20.4 security update","vulnerabilityIds":["CVE-2020-13949","CVE-2020-28362","CVE-2020-28500","CVE-2021-3114","CVE-2021-23337","CVE-2021-31525"]},{"id":"RHSA-2021:1168","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.2 security and bug fix update","vulnerabilityIds":["CVE-2020-14040","CVE-2020-28500","CVE-2020-28851","CVE-2020-28852","CVE-2020-29529","CVE-2021-21321","CVE-2021-21322","CVE-2021-23337","CVE-2021-23840","CVE-2021-23841"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2022-0424","identifiers":["EUVD-2022-0424","CVE-2020-28500","GHSA-29mw-wpgm-hmr9"]},"retained":false,"historicalAffected":[]},{"revision":"84ace46085644e358c8e29f8ff08899d","observedAt":"2026-10-24T16:17:38.504+00:00","statement":{"source":"nvd","id":"CVE-2020-28500","aliases":[],"title":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","description":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","state":0,"publishedAt":"2021-02-15T11:15:12.397+00:00","modifiedAt":"2026-10-08T22:16:59.333+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · report@snyk.io · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 2.0 · nvd@nist.gov · Primary","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","score":5,"severity":"MEDIUM"}],"references":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://github.com/lodash/lodash/pull/5065","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-28500","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["NVD-CWE-Other"],"productCriteria":["cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*","cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*","cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*","cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*","cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*","cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*","cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*"],"sourceDates":{"published":"2021-02-15T11:15:12.397","lastModified":"2026-10-08T22:16:59.333"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2020-28500","identifiers":["CVE-2020-28500"]},"retained":false,"historicalAffected":[]},{"revision":"9a434471a56c49bab5e32e0d5177562e","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-29mw-wpgm-hmr9","aliases":["CVE-2020-28500"],"title":"Regular Expression Denial of Service (ReDoS) in lodash","description":"All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions. \n\nSteps to reproduce (provided by reporter Liyuan Chen):\n```js\nvar lo = require('lodash');\n\nfunction build_blank(n) {\n    var ret = \"1\"\n    for (var i = 0; i < n; i++) {\n        ret += \" \"\n    }\n    return ret + \"1\";\n}\nvar s = build_blank(50000) var time0 = Date.now();\nlo.trim(s) \nvar time_cost0 = Date.now() - time0;\nconsole.log(\"time_cost0: \" + time_cost0);\nvar time1 = Date.now();\nlo.toNumber(s) var time_cost1 = Date.now() - time1;\nconsole.log(\"time_cost1: \" + time_cost1);\nvar time2 = Date.now();\nlo.trimEnd(s);\nvar time_cost2 = Date.now() - time2;\nconsole.log(\"time_cost2: \" + time_cost2);\n```","state":0,"publishedAt":"2022-01-06T20:30:46+00:00","modifiedAt":"2025-09-29T21:12:31.102523+00:00","affected":[{"ecosystem":"npm","name":"lodash","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.17.21"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash-es","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.17.21"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash.trimend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"last_affected","version":"4.5.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash.trim","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"last_affected","version":"4.5.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"RubyGems","name":"lodash-rails","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.17.21"}]}],"versions":["4.0.0","4.11.2","4.12.0","4.13.1","4.14.1","4.15.0","4.16.1","4.16.3","4.16.4","4.16.6","4.17.10","4.17.11","4.17.14","4.17.15","4.17.2","4.17.4","4.17.5","4.3.0","4.5.1","4.6.1"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-28500","https://github.com/github/advisory-database/pull/6139","https://github.com/lodash/lodash/pull/5065","https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7","https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-28500.yml","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://github.com/lodash/lodash","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"],"sourceUrl":"https://github.com/advisories/GHSA-29mw-wpgm-hmr9","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-29mw-wpgm-hmr9","identifiers":["GHSA-29mw-wpgm-hmr9","CVE-2020-28500"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T15:24:08.8188023+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T15:24:08.8188023+00:00","lastSuccessAt":"2026-11-10T15:24:08.9790817+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.9790869+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-a0960c299e2dafbb2e8450fb21550287bc0c3b97298514596ae2b1697fb7bc3b","complete":true,"records":422070,"lastAttemptAt":"2026-11-10T15:21:29.3452518+00:00","lastSuccessAt":"2026-11-10T15:21:29.2151501+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:21:29.3452518+00:00","snapshotPublishedAt":"2026-11-10T14:23:49+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-efc28183efe04e138ba7d91d47b051d0","complete":true,"records":13691,"lastAttemptAt":"2026-11-10T15:25:10.8168504+00:00","lastSuccessAt":"2026-11-10T13:22:39.879+00:00","error":null,"lastVerifiedAt":"2026-11-10T13:22:39.879+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13744,"expectedIdentifiers":13744,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T15:24:08.8188023+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T15:24:08.8188023+00:00","lastSuccessAt":"2026-11-10T15:24:08.9798315+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.9798317+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-738cd6499f9748c9890b05108858c833","complete":false,"records":13697,"lastAttemptAt":"2026-11-10T15:25:10.154636+00:00","lastSuccessAt":"2026-11-10T15:25:10.15+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T15:25:10.15+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13142,"expectedIdentifiers":13744,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T15:24:08.6813477+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.6813477+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T15:21:29.495451+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:21:29.495451+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-df497239f2f75af38e095cb498791dad4044a8a9a7f5f0ee6008bb732579ab9d","complete":true,"records":3081,"lastAttemptAt":"2026-11-10T15:24:08.7869291+00:00","lastSuccessAt":"2026-11-10T14:21:34.3717399+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.7869291+00:00","snapshotPublishedAt":"2026-11-10T14:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-db2f6ba81f9ad8cbb9260cd64e408b90232da96003174aeed666a4ce1c7aabd5","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T15:24:08.5102562+00:00","lastSuccessAt":"2026-11-10T15:24:05.6823404+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.5102562+00:00","snapshotPublishedAt":"2026-11-10T14:33:27+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}