Security Digest: July 19, 2026 - 5 Critical Vulnerabilities

Today’s threat landscape is dominated by five high-severity, remotely exploitable vulnerabilities affecting multiple widely deployed tools and applications. Four of the five have public exploits, and two SourceCodester issues may allow SQL injection with potential for broader compromise if exposed to the internet.

· 7 min read

Urgent Security Digest: Five High-Severity Vulnerabilities Demand Immediate Action

Executive Summary

Today’s threat landscape is dominated by five high-severity, remotely exploitable vulnerabilities affecting multiple widely deployed tools and applications. Four of the five have public exploits, and two SourceCodester issues may allow SQL injection with potential for broader compromise if exposed to the internet.

Act now: prioritize patching, disable or restrict exposed endpoints, and assume any internet-facing instance of these products is at risk until verified otherwise.

Critical Vulnerabilities

CVE-2026-16200: rt-claw RPC handler authorization bypass

  • Impact: Attackers may invoke privileged RPC functions without proper authorization, potentially allowing unauthorized actions against swarm services.
  • Affected Systems: zevorn rt-claw up to and including 0.2.0.
  • Immediate Action: Block external access to the RPC handler now, review any exposed swarm service endpoints, and check for suspicious RPC activity.
  • Mitigation: Upgrade to a fixed release as soon as one is available; until then, place the service behind strict network controls and authentication. Public exploit code is already available.

CVE-2026-16209: Gerapy project upload endpoint authentication failure

  • Impact: Remote attackers may access the project upload endpoint without authentication, potentially uploading or altering projects and triggering further compromise.
  • Affected Systems: Gerapy up to and including 0.9.13.
  • Immediate Action: Disable public access to the Gerapy server immediately, especially the project upload functionality, and verify whether the endpoint is internet-facing.
  • Mitigation: Apply the vendor patch identified by bd4891c60315f17611a3b7a651ffe0fba7cfe71e. If patching is delayed, restrict access to trusted networks only.

CVE-2026-16210: simpleui AjaxAdmin endpoint missing authentication

  • Impact: Attackers may reach the AjaxAdmin endpoint without logging in, which can expose administrative functions and enable unauthorized changes.
  • Affected Systems: newpanjing simpleui 2026.01.13.
  • Immediate Action: Restrict access now to any deployed admin interface and confirm whether the AjaxAdmin endpoint is exposed externally.
  • Mitigation: Upgrade to a fixed version when available; in the meantime, place the admin interface behind VPN, IP allowlisting, or other strong access controls. Public exploit code is available.

CVE-2026-16227: SourceCodester Class and Exam Timetabling System SQL injection in edit_subject.php

  • Impact: Remote attackers may inject SQL through the ID parameter, potentially leading to data theft, tampering, account compromise, or deeper system impact.
  • Affected Systems: SourceCodester Class and Exam Timetabling System 1.0, specifically /edit_subject.php.
  • Immediate Action: Take the application offline or block the vulnerable route if it is exposed to untrusted users. Review database logs for suspicious queries.
  • Mitigation: Apply input validation and parameterized queries immediately, then patch or replace the application. Public exploit availability raises the urgency of remediation.

CVE-2026-16228: SourceCodester Class and Exam Timetabling System SQL injection in edit_schoolyr.php

  • Impact: Remote attackers may exploit the ID parameter to run SQL injection attacks, risking data exposure and unauthorized modification.
  • Affected Systems: SourceCodester Class and Exam Timetabling System 1.0, specifically /edit_schoolyr.php.
  • Immediate Action: Assume compromise is possible if the app is internet-facing; restrict access and inspect database activity for anomalies.
  • Mitigation: Use parameterized database queries, validate all inputs, and deploy a patched or hardened build as soon as possible. Public exploit code is already circulating.

What to Do Now

  1. Prioritize exposure: Identify any internet-facing instances of rt-claw, Gerapy, simpleui, and SourceCodester timetabling systems. Treat exposed systems as highest risk.
  2. Patch or isolate: Apply the Gerapy patch immediately and move all other affected services behind VPN, IP allowlists, or temporary network blocks until fixed versions are confirmed.
  3. Assume exploit attempts are underway: Four CVEs have public exploit disclosure; do not wait for evidence of abuse before acting.

Verification steps:

  • Confirm installed versions against the affected ranges.
  • Check whether RPC, admin, upload, or edit endpoints are reachable from the public internet.
  • Review logs for unusual authentication failures, unexpected uploads, SQL errors, or repeated parameter tampering.

Monitoring recommendations:

  • Alert on access to /edit_subject.php and /edit_schoolyr.php with abnormal ID values.
  • Monitor for unauthorized RPC calls in rt-claw and unexpected project upload activity in Gerapy.
  • Watch for new admin sessions, privilege changes, or unexplained database queries across all affected systems.

Related Resources

  • Internal: Link to your internal incident response guidance and hardening checklist for exposed web applications.
  • Internal: Link to your internal advisory on emergency patching and service isolation procedures.
  • Official vendor advisories: Review vendor and maintainer advisories for rt-claw, Gerapy, simpleui, and SourceCodester products as they are published.

Keep reading