Description
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mediawiki | 1:1.31.2-1 | — |
| Debian 14 | node-jquery | 2.2.4+dfsg-4 | — |
| Debian 13 | mediawiki | 1:1.31.2-1 | — |
| Debian 13 | node-jquery | 2.2.4+dfsg-4 | — |
| Debian 12 | mediawiki | 1:1.31.2-1 | — |
| Debian 12 | node-jquery | 2.2.4+dfsg-4 | — |
| Debian 10 | otrs2 | 6.0.16-2+deb10u1 | DLA-3551-1 |
| Debian 9 | drupal7 | 7.52-2+deb9u8 | DSA-4434-1 |
| Debian 9 | mediawiki | 1:1.27.7-1~deb9u1 | DSA-4460-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | drupal7 | 7.32-1+deb8u17 | DLA-1797-1 |
| Debian 8 | jquery | 1.7.2+dfsg-3.2+deb8u6 | DLA-1777-1 |
| Debian 8 | otrs2 | 3.3.18-1+deb8u14 | DLA-2118-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | mediawiki | No fix yet | — |
| Ubuntu 26.04 LTS | mediawiki | No fix yet | — |
| Ubuntu 25.10 | mediawiki | No fix yet | — |
| Ubuntu 22.04 LTS | otrs2 | No fix yet | — |
| Ubuntu 18.04 LTS | otrs2 +2 | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | otrs2 +1 | No fix yet | — |
| Ubuntu Pro 24.04 LTS | mediawiki | No fix yet | — |
| Ubuntu Pro 22.04 LTS | mediawiki | No fix yet | — |
| Ubuntu Pro 20.04 LTS | mediawiki | No fix yet | — |
| Ubuntu Pro 18.04 LTS | jquery | 3.2.1-1ubuntu0.1~esm1 | USN-7622-1 |
| Ubuntu Pro 16.04 LTS | drupal7 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | jquery | 1.11.3+dfsg-4ubuntu0.1~esm1 | USN-7622-1 |
| Ubuntu Pro 14.04 LTS | drupal7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | jquery | 1.7.2+dfsg-2ubuntu1+esm1 | USN-7622-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | apache-commons-collections | 3.2.2-10.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | apache-commons-lang | 2.6-21.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | apache-commons-net | 3.6-3.module+el8.3.0+6805+72837426 | RHSA-2020:4847 |
| RHEL 8 | bea-stax +1 | 1.2.0-16.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | bind-dyndb-ldap | 11.3-1.module+el8.3.0+6993+104f8db0 | RHSA-2020:4670 |
| RHEL 8 | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2020:4670 |
| RHEL 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | glassfish-jaxb +3 | 2.2.11-11.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | ipa +9 | 4.8.7-12.module+el8.3.0+8223+6212645f | RHSA-2020:4670 |
| RHEL 8 | ipa-healthcheck +1 | 0.4-6.module+el8.3.0+7711+c4441980 | RHSA-2020:4670 |
| RHEL 8 | ipa-server +4 | 4.8.7-12.module+el8.3.0+8222+c1bff54a | RHSA-2020:4670 |
| RHEL 8 | jackson-core +2 | 2.10.0-1.module+el8.2.0+5059+3eb3af25 | RHSA-2020:4847 |
| RHEL 8 | jackson-jaxrs-providers +1 | 2.9.9-1.module+el8.1.0+3832+9784644d | RHSA-2020:4847 |
| RHEL 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | javassist +1 | 3.18.1-8.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | jss +1 | 4.7.3-1.module+el8.3.0+8058+d5cd4219 | RHSA-2020:4847 |
| RHEL 8 | ldapjdk +1 | 4.22.0-1.module+el8.3.0+6784+6e1e4c62 | RHSA-2020:4847 |
| RHEL 8 | opendnssec | 2.1.6-2.module+el8.3.0+6580+328a3362 | RHSA-2020:4670 |
| RHEL 8 | pcs +1 | 0.10.10-4.el8 | RHSA-2021:4142 |
| RHEL 8 | pki-ca +8 | 10.9.4-1.module+el8.3.0+8058+d5cd4219 | RHSA-2020:4847 |
| RHEL 8 | pki-servlet-engine +1 | 1:9.0.30-1.module+el8.3.0+6730+8f9c6254 | RHSA-2020:4847 |
| RHEL 8 | python-jwcrypto +1 | 0.5.0-1.module+el8.1.0+4107+4a66eb87 | RHSA-2020:4670 |
| RHEL 8 | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2020:4670 |
| RHEL 8 | python-nss +2 | 1.0.1-10.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2020:4670 |
| RHEL 8 | python-yubico +1 | 1.3.2-9.module+el8.1.0+4107+4a66eb87 | RHSA-2020:4670 |
| RHEL 8 | pyusb +1 | 1.0.0-9.module+el8.1.0+4107+4a66eb87 | RHSA-2020:4670 |
| RHEL 8 | relaxngDatatype | 2011.1-7.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | resteasy | 3.0.26-3.module+el8.2.0+5723+4574fbff | RHSA-2020:4847 |
| RHEL 8 | slapi-nis | 0.56.5-4.module+el8.3.0+8222+c1bff54a | RHSA-2020:4670 |
| RHEL 8 | slf4j +1 | 1.7.25-4.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | softhsm +1 | 2.6.0-3.module+el8.3.0+6909+fb33717d | RHSA-2020:4670 |
| RHEL 8 | stax-ex | 1.7.7-8.module+el8.2.0+5723+4574fbff | RHSA-2020:4847 |
| RHEL 8 | tomcatjss | 7.5.0-1.module+el8.3.0+7355+c59bcbd9 | RHSA-2020:4847 |
| RHEL 8 | velocity | 1.7-24.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xalan-j2 | 2.7.1-38.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xerces-j2 | 2.11.0-34.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xml-commons-apis | 1.4.01-25.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xml-commons-resolver | 1.2-26.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xmlstreambuffer | 1.5.4-8.module+el8.2.0+5723+4574fbff | RHSA-2020:4847 |
| RHEL 8 | xsom | 0-19.20110809svn.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 7 | ipa +11 | 4.6.8-5.el7 | RHSA-2020:3936 |
| RHEL 7 | pcs +1 | 0.9.169-3.el7_9.3 | RHSA-2022:7343 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-engine-api-explorer | 0.0.5-1.el7ev | RHBA-2019:1570 |
| Red Hat Rhev Manager 4 | ovirt-engine-ui-extensions | 1.0.10-1.el7ev | RHSA-2019:3023 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.6.0-1.el7ev | RHSA-2019:3024 |
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.6-1.redhat_00001.1.el7sso | RHSA-2023:1045, RHSA-2023:1044, RHSA-2023:1043 |
| Red Hat OpenStack 15 | python-XStatic-jQuery +1 | 3.4.1.0-1.el8ost | RHSA-2020:1325 |
| Red Hat OpenStack 13 | python-XStatic-jQuery | 2.2.4.1-3.el7ost | RHSA-2020:5581 |
| Red Hat OpenShift 3 | atomic-enterprise-service-catalog +1 | 1:3.11.170-1.git.1.91db82e.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.11.170-1.git.0.00cac56.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-cluster-autoscaler | 3.11.170-1.git.1.0a0df6a.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-descheduler | 3.11.170-1.git.1.9ad83f2.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-dockerregistry | 3.11.170-1.git.1.55fab05.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-metrics-server | 3.11.170-1.git.1.357f177.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-node-problem-detector | 3.11.170-1.git.1.b1f90a6.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-service-idler | 3.11.170-1.git.1.8328979.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | atomic-openshift-web-console | 3.11.170-1.git.1.3d64e8b.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | cri-o | 1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | golang-github-openshift-oauth-proxy | 3.11.170-1.git.1.b49be83.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | jenkins | 2.204.2.1580891656-1.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1579107288-1.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | openshift-ansible +4 | 3.11.170-2.git.5.8802564.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | openshift-enterprise-autoheal | 3.11.170-1.git.1.dfe6c52.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | openshift-enterprise-cluster-capacity | 3.11.170-1.git.1.661684b.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | openshift-kuryr +4 | 3.11.170-1.git.1.7265da1.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | prometheus +1 | 3.11.170-1.git.1.227bc98.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | prometheus-alertmanager +1 | 3.11.170-1.git.1.61d7960.el7 | RHBA-2020:0402 |
| Red Hat OpenShift 3 | prometheus-node-exporter +1 | 3.11.170-1.git.1.51473b7.el7 | RHBA-2020:0402 |
| Red Hat JBoss EAP 7 | eap7-apache-sshd | 2.9.2-1.redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.9.3-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.16-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-hibernate-search +5 | 5.10.13-3.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.10-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +10 | 2.12.7-1.redhat_00003.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-javaee-security-soteria +1 | 1.0.1-3.redhat_00003.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.49-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 3.0.0-6.SP07_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsp-api_2.3_spec | 2.0.0-3.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.27-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-24.Final_redhat_00023.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-jettison | 1.5.2-1.redhat_00002.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.22-1.SP3_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.9-4.GA_redhat_00003.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.16-1.Final_redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat JBoss EAP 7 | eap7-woodstox-core | 6.4.0-1.redhat_00001.1.el7eap | RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552 |
| Red Hat CloudForms 5 | ansible-tower +5 | 3.5.2-1.el7at | RHSA-2019:2587 |
| Red Hat CloudForms 5 | cfme +5 | 5.10.9.1-1.el7cf | RHSA-2019:2587 |
| Red Hat CloudForms 5 | ovirt-ansible-hosted-engine-setup | 1.0.23-1.el7ev | RHSA-2019:2587 |
| Red Hat CloudForms 5 | ovirt-ansible-roles | 1.1.7-1.el7ev | RHSA-2019:2587 |
| Red Hat CloudForms 5 | ovirt-ansible-vm-infra | 1.1.19-1.el7ev | RHSA-2019:2587 |
| Red Hat CloudForms 5 | v2v-conversion-host +2 | 1.14.2-1.el7ev | RHSA-2019:2587 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | custodia +1 | 0.6.0-3.module_el8.6.0+2881+2f24dc92 | ALSA-2020:4670 |
| AlmaLinux 8 | python3-jwcrypto | 0.5.0-1.module_el8.5.0+2641+983b221b | ALSA-2020:4670 |
| AlmaLinux 8 | python3-kdcproxy | 0.4-5.module_el8.6.0+2881+2f24dc92 | ALSA-2020:4670 |
| AlmaLinux 8 | python3-pyusb | 1.0.0-9.module_el8.5.0+2641+983b221b | ALSA-2020:4670 |
| AlmaLinux 8 | python3-qrcode +1 | 5.1-12.module_el8.5.0+2641+983b221b | ALSA-2020:4670 |
| AlmaLinux 8 | python3-yubico | 1.3.2-9.module_el8.5.0+2641+983b221b | ALSA-2020:4670 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | apache-commons-lang | 2.6-21.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | apache-commons-net | 3.6-3.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | bea-stax | 1.2.0-16.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | custodia | 0.6.0-3.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | glassfish-jaxb | 2.2.11-11.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jackson-core +2 | 2.10.0-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jackson-jaxrs-providers | 2.9.9-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | javassist | 3.18.1-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | ldapjdk | 4.22.0-1.module+el8.4.0+418+b7ae1d4a | RLSA-2020:4847 |
| Rocky Linux 8 | pcs | 0.10.10-4.el8 | RLSA-2021:4142 |
| Rocky Linux 8 | pki-servlet-engine | 1:9.0.30-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | python-jwcrypto | 0.5.0-1.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | python-kdcproxy | 0.4-5.module+el8.3.0+244+0b2ae752 | RLSA-2020:4670 |
| Rocky Linux 8 | python-nss | 1.0.1-10.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | python-qrcode | 5.1-12.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | python-yubico | 1.3.2-9.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | pyusb | 1.0.0-9.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | relaxngDatatype | 2011.1-7.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | resteasy | 3.0.26-3.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | slf4j | 1.7.25-4.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux 8 | stax-ex | 1.7.7-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | velocity | 1.7-24.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xalan-j2 | 2.7.1-38.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xerces-j2 | 2.11.0-34.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xml-commons-resolver | 1.2-26.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xsom | 0-19.20110809svn.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP6 | python-notebook | 5.7.11-bp156.4.3.1 | openSUSE-SU-2024:0231-1 |
| SUSE Package Hub 15 SP1 | python-Django | 2.2.4-bp151.3.3.1 | openSUSE-SU-2019:1872-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Django | 3.2.7-2.3 | openSUSE-SU-2026:11248-1, openSUSE-SU-2024:13887-1, openSUSE-SU-2024:11205-1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.14-1.1 | openSUSE-SU-2026:11235-1, openSUSE-SU-2024:14208-1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 | openSUSE-SU-2026:11270-1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 | openSUSE-SU-2026:10005-1 |
| openSUSE Leap 15.6 | python-notebook | 5.7.11-bp156.4.3.1 | openSUSE-SU-2024:0231-1 |
| openSUSE Leap 15.1 | python-Django | 2.2.4-lp151.2.3.1 | openSUSE-SU-2019:1839-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | rabbitmq-server | 3.7.17-r0 | — |
| Alpine v3.23 | rabbitmq-server | 3.7.17-r0 | — |
| Alpine v3.22 | rabbitmq-server | 3.7.17-r0 | — |
| Alpine v3.21 | rabbitmq-server | 3.7.17-r0 | — |
| Alpine v3.20 | rabbitmq-server | 3.7.17-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.9 | drupal7 | 7.67-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | ipa-client +10 | 4.6.8-5.amzn2 | ALAS2-2020-1519 |
| Amazon Linux 2 | pcs +1 | 0.9.169-3.amzn2.3.0.1 | ALAS2-2023-1905 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | m2crypto | 0.38.0-4 | — |
| Azure Linux 3 | orangefs | 2.9.7-7 | — |
| Azure Linux 3 | python-openstackdocstheme | No fix yet | — |
| Azure Linux 3 | python-pygments | 2.7.4-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | apache-commons-lang | 2.6-21.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | apache-commons-net | 3.6-3.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | bea-stax-api | 1.2.0-16.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | bind-dyndb-ldap | 11.3-1.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | custodia +1 | 0.6.0-3.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | glassfish-jaxb-core +2 | 2.2.11-11.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | ipa-client +13 | 4.8.7-12.0.1.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | ipa-healthcheck +1 | 0.4-6.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | jackson-core +2 | 2.10.0-1.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | jackson-jaxrs-providers +1 | 2.9.9-1.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | javassist +1 | 3.18.1-8.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | jss +1 | 4.7.3-1.module+el8.3.0+7857+983338ee | ELSA-2020-4847 |
| Oracle Linux 8 | ldapjdk +1 | 4.22.0-1.module+el8.3.0+7857+983338ee | ELSA-2020-4847 |
| Oracle Linux 8 | opendnssec | 2.1.6-2.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | pki-ca +7 | 10.9.4-1.0.1.module+el8.3.0+7857+983338ee | ELSA-2020-4847 |
| Oracle Linux 8 | pki-servlet-engine +1 | 1:9.0.30-1.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | python3-jwcrypto | 0.5.0-1.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-kdcproxy | 0.4-5.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-nss +1 | 1.0.1-10.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | python3-pyusb | 1.0.0-9.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-qrcode +1 | 5.1-12.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-yubico | 1.3.2-9.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | relaxngDatatype | 2011.1-7.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | resteasy | 3.0.26-3.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | slapi-nis | 0.56.5-4.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | slf4j +1 | 1.7.25-4.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | softhsm +1 | 2.6.0-3.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | stax-ex | 1.7.7-8.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | tomcatjss | 7.5.0-1.module+el8.3.0+7857+983338ee | ELSA-2020-4847 |
| Oracle Linux 8 | velocity | 1.7-24.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | xalan-j2 | 2.7.1-38.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | xerces-j2 | 2.11.0-34.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | xml-commons-resolver | 1.2-26.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 8 | xsom | 0-19.20110809svn.module+el8.3.0+7697+44932688 | ELSA-2020-4847 |
| Oracle Linux 7 | ipa-client +10 | 4.6.8-5.0.1.el7 | ELSA-2020-3936 |
| Oracle Linux 7 | pcs +1 | 0.9.169-3.0.1.el7_9.3 | ELSA-2022-7343 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- jQuery 3.3.1 - Prototype Pollution & XSS Exploit EDB-52141 · webapps · Apr 8, 2025
GitHub 6 repositories
-
chrisneagu/FTC-Skystone-Dark-Angels-Romania-2020 ★ 324 · Mar 8, 2021
NOTICE This repository contains the public FTC SDK for the SKYSTONE (2019-2020) competition season. If you are looking for the current season's FTC SDK software, please visit the new and permanent ho…
-
DanielRuf/snyk-js-jquery-174006 ★ 28 · Mar 30, 2019
patches for SNYK-JS-JQUERY-174006, CVE-2019-11358, CVE-2019-5428
-
DanielRuf/snyk-js-jquery-565129 ★ 27 · Apr 14, 2020
patches for SNYK-JS-JQUERY-565129, SNYK-JS-JQUERY-567880, CVE-2020-1102, CVE-2020-11023, includes the patches for SNYK-JS-JQUERY-174006, CVE-2019-11358, CVE-2019-5428
-
bitnesswise/jquery-prototype-pollution-fix ★ 6 · Jul 18, 2019
A fix for CVE-2019-11358 (prototype pollution in jquery)
-
isacaya/CVE-2019-11358 ★ 1 · Aug 5, 2023
-
Snorlyd/https-nj.gov---CVE-2019-11358 ★ 0 · May 23, 2022
Vulnearability Report of the New Jersey official site
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.webjars.npm:jquery | >= 1.1.4, < 3.4.0 | 3.4.0 | GHSA-6c3j-c64m-qhgq |
| npm | jquery | >= 1.1.4, < 3.4.0 | 3.4.0 | GHSA-6c3j-c64m-qhgq |
| NuGet | jQuery | >= 1.1.4, < 3.4.0 | 3.4.0 | GHSA-6c3j-c64m-qhgq |
| Packagist | drupal/core | >= 8.0.0, < 8.5.15 · >= 8.6.0, < 8.6.15 | 8.5.15, 8.6.15 | DRUPAL-CORE-2019-006 |
| Packagist | maximebf/debugbar | < 1.19.0 | 1.19.0 | GHSA-6c3j-c64m-qhgq |
| PyPI | django | >= 2.0a1, < 2.1.9 · >= 2.2a1, < 2.2.2 | 2.1.9, 2.2.2 | PYSEC-2026-628 |
| PyPI | django | >= 2.0a1, < 2.1.9 | 2.1.9 | GHSA-6c3j-c64m-qhgq |
| PyPI | django | >= 2.2a1, < 2.2.2 | 2.2.2 | GHSA-6c3j-c64m-qhgq |
| RubyGems | jquery-rails | < 4.3.4 | 4.3.4 | GHSA-6c3j-c64m-qhgq |
Advisories 50
- ALSA-2020:4670 Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-4026 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2021:4142 Red Hat Security Advisory: pcs security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2023:1045 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1044 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1043 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0554 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0553 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0552 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:4670 Red Hat Security Advisory: idm:DL1 and idm:client security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3936 Red Hat Security Advisory: ipa security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:3023 Red Hat Security Advisory: ovirt-engine-ui-extensions security and bug fix update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHBA-2019:1570 Red Hat Bug Fix Advisory: ovirt-engine-api-explorer bug fix and enhancement update for RHV 4.3.4 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2023-0239 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2026
- WID-SEC-2022-1947 Red Hat Single Sign On: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2026
- RHSA-2022:7343 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2020:4847 Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- WID-SEC-2026-3720 IBM Business Process Manager: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Oct 4, 2026
- RHSA-2019:3024 Red Hat Security Advisory: ovirt-web-ui security and bug fix update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- openSUSE-SU-2026:11270-1 python313-Django5-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 15, 2026
- openSUSE-SU-2026:11248-1 python313-Django-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 11, 2026
- openSUSE-SU-2026:11235-1 python313-Django4-4.2.30-4.1 on GA media SUSE / openSUSE Security Updates · Jul 10, 2026
- RHSA-2019:2587 Red Hat Security Advisory: CloudForms 4.7.9 security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2020:5581 Red Hat Security Advisory: python-XStatic-jQuery security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:1325 Red Hat Security Advisory: python-XStatic-jQuery security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2020:0402 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- USN-7622-1 jquery vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- WID-SEC-2026-1752 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 31, 2026
- openSUSE-SU-2026:10005-1 python312-Django6-6.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-4434-1 drupal7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4460-1 mediawiki - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3551-1 otrs2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2118-1 otrs2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1797-1 drupal7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1777-1 jquery - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2020:4847 Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2021:4142 Low: pcs security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2020:4670 Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2024:11205-1 python36-Django-3.2.7-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1872-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13887-1 python310-Django-4.2.11-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:0231-1 Security update for python-notebook SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1839-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14208-1 python310-Django4-4.2.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- VDE-2021-027 Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service CERT@VDE · May 14, 2025
- WID-SEC-2024-1872 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 15, 2024
- WID-SEC-2022-1948 Drupal: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 11, 2024
- WID-SEC-2023-1737 Juniper Patchday Juli 2023 BSI CERT-Bund (WID) · Jul 12, 2023
- ALAS2-2023-1905 Moderate: pcs security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 20, 2023
- ELSA-2022-7343 Important: pcs security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 3, 2022
References
- https://www.drupal.org/sa-core-2019-006
- https://www.synology.com/security/advisory/Synology_SA_19_19
- DSA-4434 vendor-advisory
- 20190421 [SECURITY] [DSA 4434-1] drupal7 security update mailing-list
- 108023 vdb-entry
- [airflow-commits] 20190428 [GitHub] [airflow] feng-tao commented on issue #5197: [AIRFLOW-XXX] Fix CVE-2019-11358 mailing-list
- [airflow-commits] 20190428 [GitHub] [airflow] feng-tao opened a new pull request #5197: [AIRFLOW-XXX] Fix CVE-2019-11358 mailing-list
- [airflow-commits] 20190428 [GitHub] [airflow] codecov-io commented on issue #5197: [AIRFLOW-XXX] Fix CVE-2019-11358 mailing-list
- [airflow-commits] 20190428 [GitHub] [airflow] XD-DENG merged pull request #5197: [AIRFLOW-XXX] Fix CVE-2019-11358 mailing-list
- [airflow-commits] 20190428 [GitHub] [airflow] XD-DENG commented on issue #5197: [AIRFLOW-XXX] Fix CVE-2019-11358 mailing-list
- [debian-lts-announce] 20190506 [SECURITY] [DLA 1777-1] jquery security update mailing-list
- FEDORA-2019-eba8e44ee6 vendor-advisory
- FEDORA-2019-1a3edd7e8a vendor-advisory
- FEDORA-2019-7eaf0bbe7c vendor-advisory
- FEDORA-2019-2a0ce0c58c vendor-advisory
- FEDORA-2019-a06dffab1c vendor-advisory
- FEDORA-2019-f563e66380 vendor-advisory
- 20190509 dotCMS v5.1.1 Vulnerabilities mailing-list
- http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
- 20190510 dotCMS v5.1.1 HTML Injection & XSS Vulnerability mailing-list
- 20190510 dotCMS v5.1.1 Vulnerabilities mailing-list
- 20190510 Re: dotCMS v5.1.1 HTML Injection & XSS Vulnerability mailing-list
- [debian-lts-announce] 20190520 [SECURITY] [DLA 1797-1] drupal7 security update mailing-list
- [oss-security] 20190603 Django: CVE-2019-12308 AdminURLFieldWidget XSS (plus patched bundled jQuery for CVE-2019-11358) mailing-list
- http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
- RHSA-2019:1456 vendor-advisory
- DSA-4460 vendor-advisory
- 20190612 [SECURITY] [DSA 4460-1] mediawiki security update mailing-list
- openSUSE-SU-2019:1839 vendor-advisory
- RHBA-2019:1570 vendor-advisory
- openSUSE-SU-2019:1872 vendor-advisory
- [roller-commits] 20190820 [jira] [Created] (ROL-2150) Fix Js security vulnerabilities detected using retire js mailing-list
- RHSA-2019:2587 vendor-advisory
- https://security.netapp.com/advisory/ntap-20190919-0001/
- RHSA-2019:3023 vendor-advisory
- RHSA-2019:3024 vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html mailing-list
- https://www.tenable.com/security/tns-2019-08
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html mailing-list
- [debian-lts-announce] 20200224 [SECURITY] [DLA 2118-1] otrs2 security update mailing-list
- http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
- https://www.tenable.com/security/tns-2020-02
- [syncope-dev] 20200423 Jquery version on 2.1.x/2.0.x mailing-list
- [flink-dev] 20200513 [jira] [Created] (FLINK-17675) Resolve CVE-2019-11358 from jquery mailing-list
- [flink-issues] 20200513 [jira] [Created] (FLINK-17675) Resolve CVE-2019-11358 from jquery mailing-list
- [flink-issues] 20200518 [jira] [Commented] (FLINK-17675) Resolve CVE-2019-11358 from jquery mailing-list
- [flink-issues] 20200518 [jira] [Updated] (FLINK-17675) Resolve CVE-2019-11358 from jquery mailing-list
- [flink-issues] 20200518 [jira] [Assigned] (FLINK-17675) Resolve CVE-2019-11358 from jquery mailing-list
- [flink-issues] 20200520 [jira] [Closed] (FLINK-17675) Resolve CVE-2019-11358 from jquery mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- [storm-dev] 20200708 [GitHub] [storm] Crim opened a new pull request #3305: [STORM-3553] Upgrade jQuery from 1.11.1 to 3.5.1 mailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://backdropcms.org/security/backdrop-sa-core-2019-009
- https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/