Daily briefing · July 19, 2026
Calm CVE Day Masks Heavy Ransomware Pressure on Brazil
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
July 19, 2026 registers as a calm day on the vulnerability front — zero CVEs weaponized, zero under active exploitation, and no VulnCheck early-warning signals — but the threat landscape is far from quiet. A batch of ten newly published flaws spans critical CI/CD pipeline compromise to supply-chain deserialization risks, demanding careful triage even in the absence of immediate in-the-wild exploitation. Meanwhile, ransomware groups are hammering Brazilian organizations across every major sector, making this a day to watch the intelligence feeds closely.
Today’s brief
- CVE-2026-44359 scores a perfect CVSS 10.0: a CI/CD workflow flaw in Meshtastic exposes repository secrets to any external pull request — no approval gate required.
- Keras unsafe deserialization (CVE-2026-12484) allows arbitrary code execution via PyTorch pickle data through a public API, a serious supply-chain risk for ML pipelines.
- Multiple proof-of-concept SQL injection and missing-authentication flaws are public across Gerapy, simpleui, django-jet, and a school timetabling system.
- Brazil is under sustained ransomware siege — LockBit5, nova, Doommageddon, qilin, and others claimed victims recently across healthcare, tech, manufacturing, and retail.
Critical highlights
1
A CVSS 10.0 flaw in Meshtastic's GitHub Actions workflow allows any external contributor's pull request to execute untrusted code with full access to repository secrets and elevated GITHUB_TOKEN permissions — no approval gate exists. Organizations using or forking Meshtastic should treat this as a critical supply-chain exposure and audit their own CI/CD pipeline configurations immediately.
2
Keras 3.15.0 invokes torch.load with weights_only=False through a public API method, enabling an attacker to deliver malicious PyTorch pickle data and achieve arbitrary code execution during model loading. ML engineering teams consuming external or user-supplied model configurations are at significant risk.
3
A malformed BLE user name — which can arise from ordinary buffer truncation, not just deliberate attack — can render Meshtastic radios completely unresponsive when managed via the iOS app. The denial-of-service condition affects mesh network availability without requiring any authentication.
4
fast-uri versions 2.3.1 through 4.1.0 fail to treat a literal backslash as an authority delimiter, creating an SSRF/request-smuggling vector when the parsed URI is later consumed by Node.js fetch, undici, or the native http/https clients. Applications that parse and forward URLs should test whether they fall within the affected version range.
5
A publicly disclosed SQL injection in SourceCodester Class and Exam Timetabling System 1.0 (edit_schoolyr.php) can be triggered remotely with no authentication barrier. With a working proof of concept already public, exploitation by opportunistic actors is plausible in the near term.
6
A second SQL injection in the same SourceCodester timetabling system (edit_subject.php) is now also public, doubling the attack surface for this product. Administrators still running version 1.0 should isolate or decommission these endpoints without delay.
7
Gerapy up to 0.9.13 exposes its Project Upload Endpoint without authentication, and a public exploit already exists. Unauthenticated remote code execution scenarios are realistic given the nature of file-upload endpoints in crawling management platforms.
8
A missing authentication flaw in simpleui's AjaxAdmin AJAX endpoint allows remote actors to invoke privileged Django admin actions without credentials. The exploit is public; any Django deployment using this UI package should verify it is patched or restricted at the network level.
9
django-jet up to 1.0.8 fails to enforce authorization on its OAuth Credential Revoke Handler, allowing remote callers to revoke credentials they do not own. A public exploit is available, and the risk is amplified in multi-tenant or SaaS Django deployments.
10
CI4MS prior to 0.31.9.0 silently discards HTML sanitization due to a CodeIgniter 4 validator behavior mismatch, meaning blog post content is stored unsanitized despite the appearance of a working validation rule. This creates a persistent XSS path that could be exploited to compromise site visitors or administrators.
Ransomware today
Ransomware activity targeting Brazilian organizations has been intense in recent days, with LockBit5 emerging as the dominant actor claiming at least eight Brazilian victims including guarnera.com.br, uniplaclages.edu.br, kenta.com.br, gruposelpe.com.br, grupoferrosider.com.br, limpebras.com.br, and technicare.com.br across business services, education, manufacturing, and technology sectors. Other groups active against Brazil include Doommageddon (Reni Farmácias Associadas, healthcare), nova (Jota Joias Premium, FMZ Tecnologia em Sistemas), qilin (PP+K), and unsafe (CCR Solutions). Over the past 30 days, lockbit5, lockbit3, ransomhub, thegentlemen, 8base, and arcusmedia have collectively driven sustained pressure on Brazilian targets.
Reni Farmácias Associadas BRDoommageddon · Healthcare
Jota Joias Premium BRnova · Consumer Services
PP+K BRqilin
CCR Solutions BRunsafe · Business Services
FMZ Tecnologia em Sistemas BRnova · Technology
guarnera.com.br BRlockbit5 · Business Services
uniplaclages.edu.br BRlockbit5 · Education
kenta.com.br BRlockbit5 · Technology
gruposelpe.com.br BRlockbit5 · Business Services
grupoferrosider.com.br BRlockbit5 · Manufacturing
limpebras.com.br BRlockbit5 · Manufacturing
technicare.com.br BRlockbit5 · Technology
lockbit5 49lockbit3 39ransomhub 35thegentlemen 208base 20arcusmedia 19
Active groups & APTs
Several threat actors have been flagged as active or updated in current intelligence feeds, including the Iranian-linked group BlackShadow, as well as coinbasecartel, kazu, kelvinsecurity, krybit, and apt73. While no confirmed victims are attributed to these actors in the current reporting window, their presence in tracking systems signals ongoing reconnaissance or operational preparation that defenders should not discount.
Brazil focus
Brazil continues to face one of the most aggressive ransomware environments in the region, with recent victims spanning healthcare (Reni Farmácias Associadas), retail (Jota Joias Premium), technology (FMZ Tecnologia em Sistemas, kenta.com.br), and business services (CCR Solutions, guarnera.com.br, gruposelpe.com.br). The breadth of sectors and the variety of active groups — from established operators like LockBit5 and qilin to newer entrants like nova and Doommageddon — indicate that no industry vertical can consider itself low-priority in the current threat environment.
Jota Joias Premiumnova · Consumer Services
PP+Kqilin
Reni Farmácias AssociadasDoommageddon · Healthcare
CCR Solutionsunsafe · Business Services
gruposelpe.com.brlockbit5 · Business Services
FMZ Tecnologia em Sistemasnova · Technology
guarnera.com.brlockbit5 · Business Services
kenta.com.brlockbit5 · Technology
Today’s recommendation: Security teams should prioritize patching CVE-2026-44359 and CVE-2026-12484 given their critical/high severity and supply-chain impact, while reviewing network exposure of Gerapy, simpleui, and django-jet instances where public exploits now exist. Brazilian organizations in healthcare, technology, and manufacturing should treat current ransomware intelligence as a direct operational warning and validate their backup integrity and incident response readiness.
With public exploits circulating for multiple flaws and ransomware groups actively targeting diverse sectors, now is the right moment to validate your own attack surface and confirm whether any of today's affected components are present — and reachable — in your environment.Every CVE above is a possible door — find out which ones are open in your environment with a free attack-surface check.Meet the Autonomous AI Pentest Agent →Previous briefings
August 6, 2026 — 10 Active Exploits, 1 Weaponized in a Day: Critical Alert Across WordPress, SharePoint, SonicWall, and MoreAugust 5, 2026 — Cisco SD-WAN, MarkLogic, and PraisonAI Lead a Batch of Critical CVEs on a Calm Exploitation DayAugust 4, 2026 — Quiet Day Masks 10 Critical CVEs: RCE, Auth Bypass, and Stack Overflows in FocusAugust 3, 2026 — Adobe Campaign Classic and WAPT Server Hit by Multiple CVSS 10.0 VulnerabilitiesAugust 2, 2026 — Bouncy Castle Mass Patch Day: Six Critical CVEs Drop Alongside SQL Injection and Auth Bypass FlawsAugust 1, 2026 — WordPress Auth Bypasses and FreeRDP Heap Flaws Top a Calm Vulnerability DayJuly 31, 2026 — Calm Day Hides Critical Flaws: Hard-coded Keys, File Uploads, and Code Injection Dominate July 31July 30, 2026 — 32 Critical CVEs, No Active Exploitation: Azure Cosmos DB and IBM Products Lead a Heavy Patch DayJuly 29, 2026 — Cisco FMC Under Active Exploit, Joomla Gridbox Cluster Hits Critical Mass with Four CVEsJuly 28, 2026 — Quiet Day Hides Critical Vulnerabilities: IBM WebSphere, Apache Axis2, and Joomla Top the ListJuly 27, 2026 — CVE-2026-16812: VeloCloud Orchestrator Under Active Exploitation as Critical Flaws Pile Up Across Enterprise and WordPress StacksJuly 26, 2026 — Quiet Vulnerability Day as Brazil Faces Ransomware Wave From Multiple GroupsJuly 25, 2026 — CVSS 10.0 in SiYuan and Auth Bypass in OpenRemote Lead a Calm Day for New ExploitsJuly 24, 2026 — Three CVSS 10.0 Microsoft Cloud Flaws Lead a Calm but Notable Patch Dayview full archive →