Security Digest: May 16, 2026 - 19 Critical Vulnerabilities

Today’s alert is broad and urgent: we have one critical memory-safety flaw with code-execution potential, one critical deserialization RCE, and a large cluster of high-severity web app issues that can lead to database theft, file deletion, file reading, XSS, and privilege escalation. Act now on exposed web apps, WordPress plugins, Python services, and any Linux/Windows hosts running the affected products.

· 12 min read

Executive Summary

Today’s alert is broad and urgent: we have one critical memory-safety flaw with code-execution potential, one critical deserialization RCE, and a large cluster of high-severity web app issues that can lead to database theft, file deletion, file reading, XSS, and privilege escalation. Act now on exposed web apps, WordPress plugins, Python services, and any Linux/Windows hosts running the affected products.

Immediate priority: patch or remove vulnerable components, disable exposed admin/plugin upload paths, and review logs for suspicious requests to AJAX, search, upload, and deserialization endpoints.

Critical Vulnerabilities

  • CVE-2020-37239: libbabl double-free bypass
    • Impact: Attackers may corrupt memory and potentially execute code.
    • Affected Systems: libbabl 0.1.62.
    • Immediate Action: Upgrade libbabl immediately and rebuild any software bundling it.
    • Mitigation: Apply the vendor fix; if you cannot patch now, remove exposure from untrusted inputs.
  • CVE-2021-47952: jsonpickle deserialization RCE
    • Impact: Malicious JSON can trigger arbitrary Python command execution.
    • Affected Systems: python jsonpickle 2.0.0.
    • Immediate Action: Stop accepting untrusted JSON through jsonpickle and upgrade now.
    • Mitigation: Patch to a safe version; treat all deserialization as untrusted until fixed.
  • CVE-2021-47976: TextPattern CMS plugin upload RCE
    • Impact: Authenticated attackers can upload PHP and gain code execution.
    • Affected Systems: TextPattern CMS 4.9.0-dev.
    • Immediate Action: Disable plugin uploads and remove public access to temp upload paths.
    • Mitigation: Upgrade to a fixed release and restrict admin access.
  • CVE-2021-47979: WordPress Backup and Restore file deletion
    • Impact: Attackers can delete arbitrary files from the WordPress install.
    • Affected Systems: Backup and Restore 1.0.3.
    • Immediate Action: Disable the plugin and audit for file deletion attempts.
    • Mitigation: Patch or remove the plugin; restore from backup if needed.
  • CVE-2020-37227: HS Brand Logo Slider unrestricted upload
    • Impact: Authenticated users can upload malicious files and achieve RCE.
    • Affected Systems: HS Brand Logo Slider 2.1.
    • Immediate Action: Block plugin file uploads and inspect web directories for new PHP files.
    • Mitigation: Update immediately; enforce server-side extension and MIME checks.
  • CVE-2021-47954: LayerBB SQL injection
    • Impact: Unauthenticated attackers can extract or alter database data.
    • Affected Systems: LayerBB 1.1.4.
    • Immediate Action: Restrict public access and monitor search requests for SQL payloads.
    • Mitigation: Patch the application and review database permissions.
  • CVE-2021-47956: EgavilanMedia PHPCRUD SQL injection
    • Impact: Unauthenticated database compromise is possible.
    • Affected Systems: PHPCRUD 1.0.
    • Immediate Action: Take the app offline or place behind access controls until patched.
    • Mitigation: Upgrade and verify all input is parameterized.
  • CVE-2020-37244: Supsystic Membership SQL injection
    • Impact: Attackers can run arbitrary SQL and steal data.
    • Affected Systems: Supsystic Membership 1.4.7.
    • Immediate Action: Disable the badges module if exposed.
    • Mitigation: Patch immediately and review DB logs for UNION/time-based probes.
  • CVE-2026-8657: jsondiffpatch prototype pollution
    • Impact: Attackers can alter object behavior and potentially influence downstream code execution.
    • Affected Systems: jsondiffpatch versions before 0.7.6.
    • Immediate Action: Upgrade to 0.7.6 or later now.
    • Mitigation: Block untrusted patch documents and validate path segments.
  • CVE-2020-37243: Supsystic Pricing Table SQL injection and XSS
    • Impact: Attackers can steal data and inject scripts into admin views.
    • Affected Systems: Supsystic Pricing Table 1.8.7.
    • Immediate Action: Disable the plugin and inspect pricing table content for injected HTML/JS.
    • Mitigation: Patch and purge malicious stored content.
  • CVE-2020-37242: Supsystic Ultimate Maps SQL injection
    • Impact: Unauthenticated data theft from the database is possible.
    • Affected Systems: Supsystic Ultimate Maps 1.1.12.
    • Immediate Action: Block public access to the affected endpoint.
    • Mitigation: Upgrade and review for blind SQLi indicators.
  • CVE-2020-37230: Syncplify.me Server! unquoted service path
    • Impact: Local attackers can escalate to SYSTEM.
    • Affected Systems: Syncplify.me Server! 5.0.37.
    • Immediate Action: Restrict local shell access and patch the service path.
    • Mitigation: Quote the service path and remove writable directories from the chain.
  • CVE-2021-47974: VX Search unquoted service path
    • Impact: Local privilege escalation to SYSTEM.
    • Affected Systems: VX Search 13.5.28.
    • Immediate Action: Check service configuration and remove writable path segments.
    • Mitigation: Update and restart services only after remediation.
  • CVE-2020-37229: OKI sPSV Port Manager unquoted service path
    • Impact: Local attackers can execute code with SYSTEM privileges.
    • Affected Systems: OKI sPSV Port Manager 1.0.41.
    • Immediate Action: Audit the service path and lock down local admin access.
    • Mitigation: Patch and quote the executable path.
  • CVE-2021-47977: WordPress Anti-Malware file read traversal
    • Impact: Unauthenticated attackers can read sensitive files.
    • Affected Systems: Anti-Malware Security and Bruteforce Firewall 4.20.59.
    • Immediate Action: Disable the duplicator_download action and inspect for file access abuse.
    • Mitigation: Update the plugin and restrict admin-ajax exposure.
  • CVE-2021-47942: HACS path traversal to auth file
    • Impact: Attackers can read credentials and refresh tokens, then take over Home Assistant.
    • Affected Systems: HACS 1.10.0.
    • Immediate Action: Block the /hacsfiles/ endpoint from untrusted networks and rotate credentials.
    • Mitigation: Patch immediately and invalidate exposed tokens.
  • CVE-2020-37245: Supsystic Digital Publications traversal and XSS
    • Impact: File exposure and stored script execution are possible.
    • Affected Systems: Supsystic Digital Publications 1.6.9.
    • Immediate Action: Disable publication editing until patched.
    • Mitigation: Update and remove any injected content from publications.
  • CVE-2021-47975: WP Learn Manager stored XSS
    • Impact: Attackers can run scripts in administrator browsers.
    • Affected Systems: WP Learn Manager 1.1.2.
    • Immediate Action: Restrict access to the field ordering page and review recent submissions.
    • Mitigation: Patch and sanitize all field metadata.
  • CVE-2021-47980: Fuel CMS blind SQL injection
    • Impact: Authenticated attackers can extract database data through timing attacks.
    • Affected Systems: Fuel CMS 1.4.13.
    • Immediate Action: Limit access to the Activity Log interface and watch for unusual delay-based queries.
    • Mitigation: Apply the fix and review database query handling.

Previously Alerted

What to Do Now

  1. Patch or remove every affected plugin, CMS module, library, and service listed above.
  2. Disable exposed admin features including uploads, plugin install pages, AJAX actions, and deserialization endpoints until fixed.
  3. Rotate credentials and tokens if HACS, WordPress, or any file-read issue may have exposed secrets.
  4. Inspect logs immediately for requests to admin-ajax.php, /search.php, upload endpoints, traversal strings, SQLi payloads, and unusual POST bodies.
  5. Verify service paths on Windows hosts and remove writable directories from unquoted paths.
  6. Rebuild and redeploy any system that may have accepted malicious files or deserialized untrusted data.

Verification steps: confirm version numbers, check package manifests and plugin inventories, and compare running binaries against known-good builds. Hunt for unexpected PHP files, changed service definitions, and new admin accounts.

Monitoring recommendations: alert on repeated 500s, time-based SQL delays, file creation in web roots, token reuse, and outbound connections from web servers after suspicious uploads.

Related Resources

  • Internal: add links to your incident response playbook and patch prioritization blog post here.
  • Official vendor advisories: review the upstream release notes and security notices for each affected product before reopening exposure.

Keep reading