🧰 Java

The items that name it 31

• What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained
  articleas classification.technologies2026-10-29
• Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
  writeupas classification.technologies2026-10-29
• Endor Labs AI SAST Finds Two Apache Kafka Zero-Days: Unbounded Memory Allocation from Brokers to Kafka Streams | Endor Labs
  writeupas classification.technologies2026-10-28
• EMudhra Intermediate CA Certificates Compromised
  advisoryas classification.technologies2026-10-22
• Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
  articleas classification.technologies2026-10-22
• Oracle Security Alert Advisory – CVE-2026-91403 (eMudhra cert revocation)
  advisoryas classification.technologies2026-10-21
• A company that vouches for websites had secret keys so weak that 8 of them were cracked
  articleas classification.technologies2026-10-21
• SBOM vs. SBOM: Comparing SBOMs from Different Tools and Lifecycle Stages | Endor Labs
  writeupas classification.technologies2026-10-16
• Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
  writeupas classification.technologies2026-10-09
• You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)
  writeupas classification.technologies2026-10-06
• Sandboxes Explained: What Each Type Actually Isolates | Blog | Endor Labs
  articleas affected products2026-10-02

  SecurityManager and bytecode verifier used to confine untrusted applets; suffered a decade of sandbox-escape CVEs; SecurityManager deprecated for removal in Java 17.

• ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
  writeupas classification.technologies2026-09-25
• [tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026
  articleas classification.technologies2026-09-24
• shinthink/blitzstrike
  repoas affected products2026-09-12

  language covered by Blitz Strike's source analysis and benchmark suite

• GhostJS
  repoas classification.technologies2026-09-07
• Ashmmmm/crockTail
  repoas classification.technologies2026-08-25
• Benchmarking Secure-and-Functional Remediation and How Snyk Agent Fix Lifts Frontier-Model Fix Rates by over 14%
  articleas classification.technologies2026-08-18
• Static Analysis Tools & Linters
  repoas classification.technologies2026-08-09
• Inside an Oracle Database SQL Injection Attack | Huntress
  writeupas classification.technologies2026-08-05
• Ghidra
  repoas classification.technologies2026-07-31
• RamanMG/Burp-MCP-Unrestricted
  repoas classification.technologies2026-07-29
• dinosn/fastjson-jsontype-rce-lab
  repoas classification.technologies2026-07-20
• Alice and Bob Learn Secure Coding: Chapter 2
  videoas technologies2026-05-11
• Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2025-59419) | depthfirst
  writeupas classification.technologies2025-10-20
• Android security checklist: theft of arbitrary files | Oversecured Blog
  articleas classification.technologies
• Content Providers and the potential weak spots they can have | Oversecured Blog
  articleas classification.technologies
• Introducing MavenGate: a supply chain attack method for Java and Android applications | Oversecured Blog
  writeupas classification.technologies
• Inside mobile taint analysis: how source-to-sink tracking finds real data-leak paths | Oversecured Blog
  articleas classification.technologies
• Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)
  writeupas classification.technologies
• Revenge of the SD-WAN: Cisco Catalyst SD-WAN Manager Auth Bypass (CVE-2026-76504)
  writeupas classification.technologies
• Finding Gadgets Like It's 2026 (Atredis Partners)
  writeupas classification.technologies