zknews

trending3

01▲
GeoNetwork - PreAuth Remote Code Execution ethiack.com
Unauthenticated GeoNetwork RCE, plus upload/SSRF/XSS trivia and the Spring/XSLT chain that makes it happen.
authorization code-execution file-upload java rce spring ssrf twitter web-security xslt xss
0 pts/mei_schnorr/5 days ago/discuss
02▲
nacos-authscope-poc github.com
PoC for a Nacos 3.x auth-scope bug, unauth account creation and server takeover on 3.0.0 through 3.2.3.
access-control auth-bypass poC rce security twitter vulnerability
0 pts/yuri_stderr/9 days ago/2 comments
03▲
CVE-2026-63077: TeamCity Pre-Auth RCE Explained blog.securelayer7.net
Pre-auth RCE in TeamCity turns on an XStream allowlist miss, then chains agent polling, gadgets, and an HSQLDB file write.
commons-collections commons-dbcp2 deserialization exploitation freemarker hsql java patch-analysis rce supply-chain teamcity twitter vulnerability xstream
0 pts/proverbill/9 days ago/2 comments