Vulnerabilities in lxsmnsyc
13 resultsCVE-2026-59940CRITICALSeroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserializationEPSS 0.8%CVE-2026-23737HIGHseroval Affected by Remote Code Execution via JSON DeserializationEPSS 0.6%CVE-2026-23956HIGHseroval affected by Denial of Service via RegExp serializationEPSS 0.5%CVE-2026-116581HIGHSeroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)EPSS 0.5%CVE-2026-24006HIGHSeroval affected by Denial of Service via Deeply Nested ObjectsEPSS 0.4%CVE-2026-23957HIGHseroval is vulnerable to Denial of Service via array serializationEPSS 0.4%CVE-2026-104845HIGHSeroval: Memory exhaustion via unchecked TypedArray length in JSON deserializationEPSS 0.4%CVE-2026-116584HIGHSeroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node lengthEPSS 0.4%CVE-2026-104846CRITICALSeroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)EPSS 0.3%CVE-2026-116580HIGHSeroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type checkEPSS 0.3%CVE-2026-23736HIGHseroval Affected by Prototype Pollution via JSON DeserializationEPSS 0.3%CVE-2026-116583MEDIUMSeroval: Code injection through a typed array's own constructor propertyEPSS 0.3%CVE-2026-116582MEDIUMSeroval: Script injection through RegExp sources in serialized outputEPSS 0.2%