LX
Vendor
lxsmnsyc
13
CVEs
0
On KEV
7
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116584 New | SE seroval lxsmnsyc | 7.5 | Oct 26 | Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length |
| CVE-2026-116583 New | SE seroval lxsmnsyc | 5.3 | Oct 26 | Seroval: Code injection through a typed array's own constructor property |
| CVE-2026-116582 New | SE seroval lxsmnsyc | 4.7 | Oct 26 | Seroval: Script injection through RegExp sources in serialized output |
| CVE-2026-116581 New | SE seroval lxsmnsyc | 7.5 | Oct 26 | Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS) |
| CVE-2026-116580 New | SE seroval lxsmnsyc | 7.3 | Oct 26 | Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check |
| CVE-2026-104846 | SE seroval lxsmnsyc | 9.8 | Oct 2 | Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940) |
| CVE-2026-104845 | SE seroval lxsmnsyc | 7.5 | Oct 2 | Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization |
| CVE-2026-59940 | SE seroval lxsmnsyc | 9.8 | Aug 18 | Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization |
| CVE-2026-24006 | SE seroval lxsmnsyc | 7.5 | Jan 22 | Seroval affected by Denial of Service via Deeply Nested Objects |
| CVE-2026-23957 | SE seroval lxsmnsyc | 7.5 | Jan 22 | seroval is vulnerable to Denial of Service via array serialization |
| CVE-2026-23956 | SE seroval lxsmnsyc | 7.5 | Jan 22 | seroval affected by Denial of Service via RegExp serialization |
| CVE-2026-23737 | SE seroval lxsmnsyc | 7.5 | Jan 21 | seroval Affected by Remote Code Execution via JSON Deserialization |
| CVE-2026-23736 | SE seroval lxsmnsyc | 9.8 | Jan 21 | seroval Affected by Prototype Pollution via JSON Deserialization |