Daily briefing · July 19, 2026
Calm CVE Day Masks Heavy Ransomware Pressure on Brazil
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
July 19, 2026 registers as a calm day on the vulnerability front — zero CVEs weaponized, zero under active exploitation, and no VulnCheck early-warning signals — but the threat landscape is far from quiet. A batch of ten newly published flaws spans critical CI/CD pipeline compromise to supply-chain deserialization risks, demanding careful triage even in the absence of immediate in-the-wild exploitation. Meanwhile, ransomware groups are hammering Brazilian organizations across every major sector, making this a day to watch the intelligence feeds closely.
Today’s brief
- CVE-2026-44359 scores a perfect CVSS 10.0: a CI/CD workflow flaw in Meshtastic exposes repository secrets to any external pull request — no approval gate required.
- Keras unsafe deserialization (CVE-2026-12484) allows arbitrary code execution via PyTorch pickle data through a public API, a serious supply-chain risk for ML pipelines.
- Multiple proof-of-concept SQL injection and missing-authentication flaws are public across Gerapy, simpleui, django-jet, and a school timetabling system.
- Brazil is under sustained ransomware siege — LockBit5, nova, Doommageddon, qilin, and others claimed victims recently across healthcare, tech, manufacturing, and retail.
Critical highlights
1
A CVSS 10.0 flaw in Meshtastic's GitHub Actions workflow allows any external contributor's pull request to execute untrusted code with full access to repository secrets and elevated GITHUB_TOKEN permissions — no approval gate exists. Organizations using or forking Meshtastic should treat this as a critical supply-chain exposure and audit their own CI/CD pipeline configurations immediately.
2
Keras 3.15.0 invokes torch.load with weights_only=False through a public API method, enabling an attacker to deliver malicious PyTorch pickle data and achieve arbitrary code execution during model loading. ML engineering teams consuming external or user-supplied model configurations are at significant risk.
3
A malformed BLE user name — which can arise from ordinary buffer truncation, not just deliberate attack — can render Meshtastic radios completely unresponsive when managed via the iOS app. The denial-of-service condition affects mesh network availability without requiring any authentication.
4
fast-uri versions 2.3.1 through 4.1.0 fail to treat a literal backslash as an authority delimiter, creating an SSRF/request-smuggling vector when the parsed URI is later consumed by Node.js fetch, undici, or the native http/https clients. Applications that parse and forward URLs should test whether they fall within the affected version range.
5
A publicly disclosed SQL injection in SourceCodester Class and Exam Timetabling System 1.0 (edit_schoolyr.php) can be triggered remotely with no authentication barrier. With a working proof of concept already public, exploitation by opportunistic actors is plausible in the near term.
6
A second SQL injection in the same SourceCodester timetabling system (edit_subject.php) is now also public, doubling the attack surface for this product. Administrators still running version 1.0 should isolate or decommission these endpoints without delay.
7
Gerapy up to 0.9.13 exposes its Project Upload Endpoint without authentication, and a public exploit already exists. Unauthenticated remote code execution scenarios are realistic given the nature of file-upload endpoints in crawling management platforms.
8
A missing authentication flaw in simpleui's AjaxAdmin AJAX endpoint allows remote actors to invoke privileged Django admin actions without credentials. The exploit is public; any Django deployment using this UI package should verify it is patched or restricted at the network level.
9
django-jet up to 1.0.8 fails to enforce authorization on its OAuth Credential Revoke Handler, allowing remote callers to revoke credentials they do not own. A public exploit is available, and the risk is amplified in multi-tenant or SaaS Django deployments.
10
CI4MS prior to 0.31.9.0 silently discards HTML sanitization due to a CodeIgniter 4 validator behavior mismatch, meaning blog post content is stored unsanitized despite the appearance of a working validation rule. This creates a persistent XSS path that could be exploited to compromise site visitors or administrators.
Ransomware today
Ransomware activity targeting Brazilian organizations has been intense in recent days, with LockBit5 emerging as the dominant actor claiming at least eight Brazilian victims including guarnera.com.br, uniplaclages.edu.br, kenta.com.br, gruposelpe.com.br, grupoferrosider.com.br, limpebras.com.br, and technicare.com.br across business services, education, manufacturing, and technology sectors. Other groups active against Brazil include Doommageddon (Reni Farmácias Associadas, healthcare), nova (Jota Joias Premium, FMZ Tecnologia em Sistemas), qilin (PP+K), and unsafe (CCR Solutions). Over the past 30 days, lockbit5, lockbit3, ransomhub, thegentlemen, 8base, and arcusmedia have collectively driven sustained pressure on Brazilian targets.
Reni Farmácias Associadas BRDoommageddon · Healthcare
Jota Joias Premium BRnova · Consumer Services
PP+K BRqilin
CCR Solutions BRunsafe · Business Services
FMZ Tecnologia em Sistemas BRnova · Technology
guarnera.com.br BRlockbit5 · Business Services
uniplaclages.edu.br BRlockbit5 · Education
kenta.com.br BRlockbit5 · Technology
gruposelpe.com.br BRlockbit5 · Business Services
grupoferrosider.com.br BRlockbit5 · Manufacturing
limpebras.com.br BRlockbit5 · Manufacturing
technicare.com.br BRlockbit5 · Technology
lockbit5 49lockbit3 39ransomhub 35thegentlemen 208base 20arcusmedia 19
Active groups & APTs
Several threat actors have been flagged as active or updated in current intelligence feeds, including the Iranian-linked group BlackShadow, as well as coinbasecartel, kazu, kelvinsecurity, krybit, and apt73. While no confirmed victims are attributed to these actors in the current reporting window, their presence in tracking systems signals ongoing reconnaissance or operational preparation that defenders should not discount.
Brazil focus
Brazil continues to face one of the most aggressive ransomware environments in the region, with recent victims spanning healthcare (Reni Farmácias Associadas), retail (Jota Joias Premium), technology (FMZ Tecnologia em Sistemas, kenta.com.br), and business services (CCR Solutions, guarnera.com.br, gruposelpe.com.br). The breadth of sectors and the variety of active groups — from established operators like LockBit5 and qilin to newer entrants like nova and Doommageddon — indicate that no industry vertical can consider itself low-priority in the current threat environment.
Jota Joias Premiumnova · Consumer Services
PP+Kqilin
Reni Farmácias AssociadasDoommageddon · Healthcare
CCR Solutionsunsafe · Business Services
gruposelpe.com.brlockbit5 · Business Services
FMZ Tecnologia em Sistemasnova · Technology
guarnera.com.brlockbit5 · Business Services
kenta.com.brlockbit5 · Technology
Today’s recommendation: Security teams should prioritize patching CVE-2026-44359 and CVE-2026-12484 given their critical/high severity and supply-chain impact, while reviewing network exposure of Gerapy, simpleui, and django-jet instances where public exploits now exist. Brazilian organizations in healthcare, technology, and manufacturing should treat current ransomware intelligence as a direct operational warning and validate their backup integrity and incident response readiness.
With public exploits circulating for multiple flaws and ransomware groups actively targeting diverse sectors, now is the right moment to validate your own attack surface and confirm whether any of today's affected components are present — and reachable — in your environment.Every CVE above is a possible door — find out which ones are open in your environment with a free attack-surface check.Meet the Autonomous AI Pentest Agent →Previous briefings
September 8, 2026 — Windows Under Active Exploit, ScreenConnect Zero-Day Detected Before CISA: September 8 Security BulletinSeptember 7, 2026 — 22 Critical CVEs Published on a Quiet Day, With Heavy Ransomware Pressure on BrazilSeptember 6, 2026 — Quiet Day Hides Real Risks: Tenda HG10, NEC UNIVERGE, and Brazilian Ransomware Surge Demand AttentionSeptember 5, 2026 — WordPress Plugin Wave and Tenda CP3 Flaws Lead a Calm But CVE-Heavy DaySeptember 4, 2026 — WordPress Plugins and FreeIPMI Lead a Calm but Patch-Heavy DaySeptember 3, 2026 — Four CVSS 10.0 Critical CVEs Headline a Calm But Dense Vulnerability DaySeptember 2, 2026 — WordPress Plugins Under Fire, Cisco IOS XR and NX-OS in the Crosshairs: ATTENTION Day With Active ExploitationSeptember 1, 2026 — Active Exploitation of Proxmox and SonicWall SMA1000 Leads a High-Alert DayAugust 31, 2026 — WordPress Plugins and Tenda Routers Dominate a High-Alert Day With 41 Critical CVEsAugust 30, 2026 — Calm Day Hides Sharp Edges: Critical Code Injection and Router Flaws Top August 30 BulletinAugust 29, 2026 — Ten Active-Exploitation CVEs Dominate as Ransomware Groups Hammer BrazilAugust 28, 2026 — 10 Actively Exploited CVEs Demand Immediate Action: Metabase, VMware, macOS, Cisco, and More Under FireAugust 27, 2026 — Router Firmware Under Active Exploitation and WordPress Wave Raises Alerts on August 27August 26, 2026 — Ubiquiti UniFi and Gitea Face Active Exploitation Alerts as 62 Critical CVEs Emergeview full archive →