[geoserver]

August 15, 2026

• GeoServer is under active exploitation via an unpatched SQL-injection zero-day that chains to remote code execution (SecurityWeek). · Vulnerabilities & Exploits

in A Heavy Day for Exploit Research and In-the-Wild N-Days

June 26, 2026

• CVE-2025-52465 ("GeoLocate") in GeoServer is being exploited in the wild — admins can dump plaintext master passwords, enabling JSP webshell injection and (on Windows with UNC paths) NTLM credential leakage. partywave.site · Vulnerabilities & Exploits

in Malware Weaponizes Prompt Injection to Sabotage AI Analysis as Gamaredon Retools Against Ukraine