Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-174:02 advisory.

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:2452 advisory.

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:2452 advisory.

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:2438 advisory.

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20185-1 advisory.

    - CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods     from global       (bsc#1257325).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-2438 advisory.

    [0.12.1-1.el10_1.2]
    - Fixed CVE-2025-13465 by updating pcs-web-ui to 0.1.23.1       Resolves: RHEL-144292

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2484 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725)

    * tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2469 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725)

    * tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-2452 advisory.

    [0.11.10-1.el9_7.2]
    - Fixed CVE-2025-13465 by updating pcs-web-ui to 0.1.23.1       Resolves: RHEL-144292

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:2452 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:2438 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2465 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725)

    * tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2462 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725)

    * tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20177-1 advisory.

    Update to version 3.5.0:

    Security issues fixed:

    - CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods     from global (bsc#1257329).
    - CVE-2025-12816: interpretation conflict vulnerability allowing bypassing cryptographic verifications     (bsc#1255588).

    Other updates and bugfixes:

    - Update to 3.5.0 (jsc#PED-13824):

      * [FEATURE] Remote-write: Add support for Azure Workload Identity         as an authentication method for the receiver.
      * [FEATURE] PromQL: Add first_over_time(...) and         ts_of_first_over_time(...) behind feature flag.
      * [FEATURE] Federation: Add support for native histograms with         custom buckets (NHCB).
      * [ENHANCEMENT] PromQL: Add warn-level annotations for counter         reset conflicts in certain histogram operations.
      * [ENHANCEMENT] UI: Add scrape interval and scrape timeout to         targets page.

    - Update to 3.4.0:

      * Add unified AWS service discovery for ec2, lightsail and ecs services.
      * [FEATURE] Native histograms are now a stable, but optional         feature.
      * [FEATURE] UI: Show detailed relabeling steps for each         discovered target.
      * [ENHANCEMENT] Alerting: Add unknown state for alerting rules         that haven't been evaluated yet.
      * [BUGFIX] Scrape: Fix a bug where scrape cache would not be         cleared on startup.

    - Update to 3.3.0:

      * [FEATURE] Spring Boot 3.3 includes support for the Prometheus         Client 1.x.
      * [ENHANCEMENT] Dependency management for Dropwizard Metrics has         been removed.

    - Update to 3.2.0:

      * [FEATURE] OAuth2: support jwt-bearer grant-type (RFC7523 3.1).
      * [ENHANCEMENT] PromQL: Reconcile mismatched NHCB bounds in Add         and Sub.
      * [BUGFIX] TSDB: Native Histogram Custom Bounds with a NaN         threshold are now rejected.

    - Update to 3.1.0:

      * [FEATURE] Remote-write 2 (receiving): Update to 2.0-rc.4 spec.
        created timestamp (CT) is now called start timestamp (ST).
      * [BUGFIX] Mixin: Add static UID to the remote-write dashboard.

    - Update to 3.0.1:

      * [BUGFIX] Promql: Make subqueries left open.
      * [BUGFIX] Fix memory leak when query log is enabled.
      * [BUGFIX] Support utf8 names on /v1/label/:name/values endpoint.

    - Update to 3.0.0:

      * [CHANGE] Deprecated feature flags removed.
      * [FEATURE] New UI.
      * [FEATURE] Remote Write 2.0.
      * [FEATURE] OpenTelemetry Support.
      * [FEATURE] UTF-8 support is now stable and enabled by default.
      * [FEATURE] OTLP Ingestion.
      * [FEATURE] Native Histograms.
      * [BUGFIX] PromQL: Fix count_values for histograms.
      * [BUGFIX] TSDB: Fix race on stale values in headAppender.
      * [BUGFIX] UI: Fix selector / series formatting for empty metric         names.

    - Update to 2.55.0:

      * [FEATURE] PromQL: Add `last_over_time` function.
      * [FEATURE] Agent: Add `prometheus_agent_build_info` metric.
      * [ENHANCEMENT] PromQL: Optimise `group()` and `group by()`.
      * [ENHANCEMENT] TSDB: Reduce memory usage when loading blocks.
      * [BUGFIX] Scrape: Fix a bug where a target could be scraped         multiple times.

    - Update to 2.54.0:

      * [CHANGE] Remote-Write: highest_timestamp_in_seconds and         queue_highest_sent_timestamp_seconds metrics now initialized to         0.
      * [CHANGE] API: Split warnings from info annotations in API         response.
      * [FEATURE] Remote-Write: Version 2.0 experimental, plus metadata         in WAL via feature flag.
      * [FEATURE] PromQL: add limitk() and limit_ratio() aggregation         operators.
      * [ENHANCEMENT] PromQL: Accept underscores in literal numbers.
      * [ENHANCEMENT] PromQL: float literal numbers and durations are         now interchangeable (experimental).
      * [ENHANCEMENT] PromQL (experimental native histograms): Optimize         histogram_count and histogram_sum functions.
      * [BUGFIX] PromQL: Fix various issues with native histograms.
      * [BUGFIX] TSDB: Fix race on stale values in headAppender.
      * [BUGFIX] OTLP receiver: Allow colons in non-standard units.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20182-1 advisory.

    - CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods     from global       prototypes (bsc#1257324).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20181-1 advisory.

    - CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods     from global       prototypes (bsc#1257324).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2809f801f3 advisory.

    Regenerate vendor tarball. Fixes CVE-2025-13465.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-84de1534b1 advisory.

    This update bumps the bundled lodash to 4.17.23 to ensure openQA is protected against     [CVE-2025-13465](https://www.cve.org/CVERecord?id=CVE-2025-13465). It likely was not vulnerable in any     case, though, as I don't believe the vulnerable codepaths were exposed by openQA's use of lodash.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3062e10d87 advisory.

    Regenerate vendor tarball. Fixes CVE-2025-13465.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4e47f4d911 advisory.

    Regenerate vendor tarball. Fixes CVE-2025-13465.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a75abb3f2b advisory.

    Regenerate vendor tarball. Fixes CVE-2025-13465.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d3c5092654 advisory.

    See https://github.com/mwouts/jupytext/blob/main/CHANGELOG.md for changes in versions 1.19.0 and 1.19.1.
    This update contains a fix for [CVE-2025-13465](https://nvd.nist.gov/vuln/detail/CVE-2025-13465).


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-abd2d2d60c advisory.

    This update provides new upstream snapshots of openQA and os-autoinst, with various fixes and     enhancements. Please see upstream changelogs for details. They also address a CVE by updating a bundled     javascript library, though we're fairly sure openQA didn't actually expose the vulnerability anyway.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9111b2e330 advisory.

    See https://github.com/mwouts/jupytext/blob/main/CHANGELOG.md for changes in versions 1.19.0 and 1.19.1.
    This update contains a fix for [CVE-2025-13465](https://nvd.nist.gov/vuln/detail/CVE-2025-13465).


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit     functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.
    The issue permits deletion of properties but does not allow overwriting their original behavior. This     issue is patched on 4.17.23 (CVE-2025-13465)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
299002	MiracleLinux 9 : pcs-0.11.10-1.el9_7.2.ML.1 (AXSA:2026-174:02)	Nessus	Miracle Linux Local Security Checks	high
298955	RockyLinux 9 : pcs (RLSA-2026:2452)	Nessus	Rocky Linux Local Security Checks	high
298847	AlmaLinux 9 : pcs (ALSA-2026:2452)	Nessus	Alma Linux Local Security Checks	high
298797	AlmaLinux 10 : pcs (ALSA-2026:2438)	Nessus	Alma Linux Local Security Checks	high
298724	openSUSE 16 Security Update : cockpit-packages (openSUSE-SU-2026:20185-1)	Nessus	SuSE Local Security Checks	high
298610	Oracle Linux 10 : pcs (ELSA-2026-2438)	Nessus	Oracle Linux Local Security Checks	high
298607	RHEL 9 : pcs (RHSA-2026:2484)	Nessus	Red Hat Local Security Checks	high
298606	RHEL 8 : pcs (RHSA-2026:2469)	Nessus	Red Hat Local Security Checks	high
298595	Oracle Linux 9 : pcs (ELSA-2026-2452)	Nessus	Oracle Linux Local Security Checks	high
298589	RHEL 9 : pcs (RHSA-2026:2452)	Nessus	Red Hat Local Security Checks	high
298542	RHEL 10 : pcs (RHSA-2026:2438)	Nessus	Red Hat Local Security Checks	high
298540	RHEL 8 : pcs (RHSA-2026:2465)	Nessus	Red Hat Local Security Checks	high
298530	RHEL 8 : pcs (RHSA-2026:2462)	Nessus	Red Hat Local Security Checks	high
298293	openSUSE 16 Security Update : golang-github-prometheus-prometheus (openSUSE-SU-2026:20177-1)	Nessus	SuSE Local Security Checks	high
298292	openSUSE 16 Security Update : cockpit (openSUSE-SU-2026:20182-1)	Nessus	SuSE Local Security Checks	high
298291	openSUSE 16 Security Update : cockpit-subscriptions (openSUSE-SU-2026:20181-1)	Nessus	SuSE Local Security Checks	high
298217	Fedora 42 : yarnpkg (2026-2809f801f3)	Nessus	Fedora Local Security Checks	high
298215	Fedora 42 : openqa (2026-84de1534b1)	Nessus	Fedora Local Security Checks	high
298214	Fedora 42 : pgadmin4 (2026-3062e10d87)	Nessus	Fedora Local Security Checks	high
298003	Fedora 43 : pgadmin4 (2026-4e47f4d911)	Nessus	Fedora Local Security Checks	high
297997	Fedora 43 : yarnpkg (2026-a75abb3f2b)	Nessus	Fedora Local Security Checks	high
297765	Fedora 42 : python-jupytext (2026-d3c5092654)	Nessus	Fedora Local Security Checks	high
297763	Fedora 43 : openqa / os-autoinst (2026-abd2d2d60c)	Nessus	Fedora Local Security Checks	high
297762	Fedora 43 : python-jupytext (2026-9111b2e330)	Nessus	Fedora Local Security Checks	high
294906	Linux Distros Unpatched Vulnerability : CVE-2025-13465	Nessus	Misc.	high

Detections

Analytics

CVE-2025-13465

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high