Sunday, May 17, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

🎯 SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Sunday's disclosures center on a Python serialization flaw in jsonpickle and digital signage and image-processing libraries, alongside actively exploited issues in Cisco Catalyst SD-WAN and Microsoft products. The day brought 3 critical CVEs (down 50% from the prior day) and 57 high-priority CVEs (up 46%), reflecting a shift toward high-severity rather than critical-rated issues. Notable critical entries include CVE-2021-47952 in Python jsonpickle, CVE-2020-37228 in iDS6 DSSPro Digital Signage System, and CVE-2020-37239 in libbabl. Remote code execution and deserialization weaknesses dominate the critical set, while the Cisco and Microsoft KEV entries indicate ongoing targeting of enterprise network and platform infrastructure. No vendor patches are currently linked in today's data, so teams should rely on vendor advisories and apply mitigations or workarounds where available.

  • Python jsonpickle deserialization flaw (CVE-2021-47952, CVSS 9.8) leads the critical set with potential for remote code execution
  • Critical CVEs: 3 (down 50% from 6 the prior day)
  • High-priority CVEs: 57 (up 46% from 39 the prior day)
  • Remote code execution and unsafe deserialization patterns affect Python jsonpickle, iDS6 DSSPro digital signage, and the libbabl image library
  • Patch availability sits at 0% across today's set; teams should consult vendor advisories directly for mitigations
  • 2 actively exploited CVEs reported in Cisco Catalyst SD-WAN (CVE-2026-20182) and Microsoft (CVE-2026-42897), both CVSS 9.5

Immediate action: Prioritize the actively exploited Cisco Catalyst SD-WAN and Microsoft issues for immediate review, and audit any use of Python jsonpickle, iDS6 DSSPro digital signage, and libbabl across your environment. With no patches currently linked in today's data, rely on vendor advisories for fixed versions and apply available workarounds, network restrictions, or input validation controls in the interim.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation