Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Oct 26, 2026Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-116584 · Other software · lxsmnsyc · reported by GitHubHigh 7.5
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. This issue is a residual bypass of the remediation for CVE-2026-23957. This issue is fixed in version 1.6.8.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-116583 · Other software · lxsmnsyc · reported by GitHubMedium 5.3
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-116582 · Other software · lxsmnsyc · reported by GitHubMedium 4.7
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application is affected when it builds regular expression syntax from untrusted input, serializes that RegExp through serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, and embeds the result in an HTML script element. The crafted source can terminate the element and execute script in the page received by another user. This issue is fixed in version 1.6.10.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-116581 · Other software · lxsmnsyc · reported by GitHubHigh 7.5
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-116580 · Other software · lxsmnsyc · reported by GitHubHigh 7.3
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an application plugin that returns a callable value or an object exposing an on method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value. This is an incomplete-fix variant of CVE-2026-59940. The resulting confidentiality, integrity, or availability impact depends on the behavior exposed by the application plugin. This issue is fixed in version 1.6.8.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-104846 · Other software · lxsmnsyc · reported by GitHubCritical 9.8
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-104845 · Other software · lxsmnsyc · reported by GitHubHigh 7.5
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can provide a small untrusted JSON object with a large length value, causing the array-like TypedArray constructor to synchronously allocate the selected number of elements and exhaust CPU or memory while starving the event loop. The offset check does not reject the crafted source because source.byteLength is undefined. DataView reaches a similar unchecked cast but throws rather than allocating, and the issue has no identified confidentiality or integrity impact. This issue is fixed in version 1.6.3.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-59940 · Other software · lxsmnsyc · reported by GitHubCritical 9.8
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-24006 · Other software · lxsmnsyc · reported by GitHubHigh 7.5
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-23957 · Other software · lxsmnsyc · reported by GitHubHigh 7.5
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time. This issue has been fixed in version 1.4.1.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-23956 · Other software · lxsmnsyc · reported by GitHubHigh 7.5
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-23737 · Other software · lxsmnsyc · reported by GitHubHigh 7.5
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution. Exploitation is possible via overriding constant value and error deserialization, allowing indirect access to unsafe JS evaluation. At minimum, attackers need the ability to perform 4 separate requests on the same function, and partial knowledge of how the serialized data is used during later runtime processing. This vulnerability affects the fromJSON and fromCrossJSON functions in a client-to-server transmission scenario. This issue has been fixed in version 1.4.0.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.CVE-2026-23736 · Other software · lxsmnsyc · reported by GitHubHigh 7.3
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This vulnerability affects only JSON deserialization functionality. This issue is fixed in version 1.4.1.
- Product
- seroval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.