[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPH-c7rL7jOUUilLH6xYH59jEWfwB2Pe1e7vr6XXcIuM":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":19,"kevVulnerabilities":79,"topProductsByCves":80,"seoMetadata":82,"meta":91},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":18},18354,"lua",1,17,0,40,"2023-04-10","l",[16],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},105358,"Lua is a technology vendor with 1 tracked product and 17 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[20,29,37,43,50,55,61,66,71,75],{"cveId":21,"description":22,"publishedDate":23,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":28},"CVE-2019-6706","Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.","2019-01-23",7.5,"v3.1","High",false,0.17359,{"cveId":30,"description":31,"publishedDate":32,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":27,"epssScore":36},"CVE-2014-5461","Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.","2014-09-04",5,"v2","Medium",0.12029,{"cveId":38,"description":39,"publishedDate":40,"cvssScore":41,"cvssVersion":25,"severity":35,"isKev":27,"epssScore":42},"CVE-2020-24370","ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).","2020-08-17",5.3,0.03833,{"cveId":44,"description":45,"publishedDate":46,"cvssScore":47,"cvssVersion":25,"severity":48,"isKev":27,"epssScore":49},"CVE-2022-28805","singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.","2022-04-08",9.1,"Critical",0.02976,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":54},"CVE-2022-33099","An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.","2022-07-01",0.02841,{"cveId":56,"description":57,"publishedDate":58,"cvssScore":59,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":60},"CVE-2020-15888","Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.","2020-07-21",8.8,0.02435,{"cveId":62,"description":63,"publishedDate":58,"cvssScore":64,"cvssVersion":25,"severity":48,"isKev":27,"epssScore":65},"CVE-2020-15889","Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.",9.8,0.02232,{"cveId":67,"description":68,"publishedDate":69,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":70},"CVE-2021-32918","An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3.","2021-05-13",0.02115,{"cveId":72,"description":73,"publishedDate":40,"cvssScore":41,"cvssVersion":25,"severity":35,"isKev":27,"epssScore":74},"CVE-2020-24371","lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.",0.01745,{"cveId":76,"description":77,"publishedDate":40,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":78},"CVE-2020-24369","ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference.",0.01684,[],[81],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},{"title":83,"metaDescription":84,"keywords":85,"structuredData":86},"Lua - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Lua covering 1 product with 17 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Lua vulnerabilities, Lua security, Lua CVE, Lua threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":87,"@type":88,"name":89,"description":84,"url":90},"https:\u002F\u002Fschema.org","Organization","Lua","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Flua",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":92,"apiVersion":93},"2026-10-17T14:55:29.680Z","3.0"]