Critical vulnerabilities, curated daily for security professionals
📊
Archived Security Brief
Sunday's disclosures center on a Python serialization flaw in jsonpickle and digital signage and image-processing libraries, alongside actively exploited issues in Cisco Catalyst SD-WAN and Microsoft products. The day brought 3 critical CVEs (down 50% from the prior day) and 57 high-priority CVEs (up 46%), reflecting a shift toward high-severity rather than critical-rated issues. Notable critical entries include CVE-2021-47952 in Python jsonpickle, CVE-2020-37228 in iDS6 DSSPro Digital Signage System, and CVE-2020-37239 in libbabl. Remote code execution and deserialization weaknesses dominate the critical set, while the Cisco and Microsoft KEV entries indicate ongoing targeting of enterprise network and platform infrastructure. No vendor patches are currently linked in today's data, so teams should rely on vendor advisories and apply mitigations or workarounds where available.
Python jsonpickle deserialization flaw (CVE-2021-47952, CVSS 9.8) leads the critical set with potential for remote code execution
Critical CVEs: 3 (down 50% from 6 the prior day)
High-priority CVEs: 57 (up 46% from 39 the prior day)
Remote code execution and unsafe deserialization patterns affect Python jsonpickle, iDS6 DSSPro digital signage, and the libbabl image library
Patch availability sits at 0% across today's set; teams should consult vendor advisories directly for mitigations
2 actively exploited CVEs reported in Cisco Catalyst SD-WAN (CVE-2026-20182) and Microsoft (CVE-2026-42897), both CVSS 9.5
Immediate action: Prioritize the actively exploited Cisco Catalyst SD-WAN and Microsoft issues for immediate review, and audit any use of Python jsonpickle, iDS6 DSSPro digital signage, and libbabl across your environment. With no patches currently linked in today's data, rely on vendor advisories for fixed versions and apply available workarounds, network restrictions, or input validation controls in the interim.
How to read this brief
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
No / Low / High privileges — the access they need first. No privileges means no login required.
No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove
Seven sandbox escapes in vm2 Node.js library disclosed in one day
Seven independent sandbox-escape vulnerabilities in the vm2 Node.js sandbox library were disclosed together on May 13-14, 2026. Each lets attacker-controlled JavaScript break out of the sandbox and run as the host Node.js process. All seven were patched in 3.11.0 or 3.11.2, but the cluster is the latest in a long pattern of vm2 escapes — the editorial recommendation is to migrate away from vm2, not just upgrade.
The python jsonpickle library contains a remote code execution vulnerability via deserialization of malicious JSON payloads containing py/repr objects.
The iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA bypass vulnerability that allows attackers to retrieve valid codes and perform brute-force attacks against user accounts.
libbabl 0.1.62 contains a memory safety vulnerability where a broken double-free detection allows attackers to bypass checks and achieve memory corruption.
A high-severity vulnerability has been identified in the Open WebUI self-hosted AI platform, requiring immediate review of vendor-provided security patches.
Open WebUI, a self-hosted AI platform, contains a high-severity vulnerability that requires immediate remediation through vendor-issued security updates.