Curated security research, vulnerabilities, advisories and tools for practitioners.

#java

Security coverage tagged java.

1.

Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject

vulnerability | Critical | 2026-08-26 15:44 | github.com | original ↗ | #rce | #public-poc | #java

2.

Modernize Java with Cursor and GitLab

blog | 2026-07-22 00:00 | about.gitlab.com | original ↗ | #ai-security | #gitlab | #devops

3.

Chaining an Apache ActiveMQ RCE on a Fully Patched 6.2.5 (CVE-2026-34197)

vulnerability | High | 2026-07-02 10:18 | CVE-2026-34197 | crowdfense.com | original ↗ | #rce | #public-poc | #featured

4.

How to write your first obfuscator of Java Bytecode

research | 2026-02-04 23:00 | blog.quarkslab.com | original ↗ | #java | #obfuscation | #asm

5.

Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2025-59419)

vulnerability | Medium | 2025-10-20 00:00 | CVE-2025-59419 | depthfirst.com | original ↗ | #vulnerability-research | #java | #command-injection

6.

Don’t recurse on untrusted input

blog | 2025-02-21 05:00 | blog.trailofbits.com | original ↗ | #java | #vulnerability-disclosure | #codeql

7.

Under the Radar: Exploring Spring Boot Actuator Misconfigurations

blog | 2024-12-16 14:00 | wiz.io | original ↗ | #rce | #cloud-security | #java

8.

Unlocking the Power of Generics in Programming

blog | 2024-04-01 02:01 | hackerone.com | original ↗ | #java | #software-engineering | #programming

9.

Hiding payloads in Java source code strings

research | 2024-01-24 12:27 | portswigger.net | original ↗ | #rce | #burp-suite | #java

10.

30 new Semgrep rules: Ansible, Java, Kotlin, shell scripts, and more

blog | 2024-01-17 13:30 | blog.trailofbits.com | original ↗ | #java | #sast | #static-analysis

11.

Introducing Bambdas

blog | 2023-11-14 08:27 | portswigger.net | original ↗ | #burp-suite | #java | #bambdas

12.

Power Up Your Pen Tests: Creating Burp Suite Extensions with the New Montoya API

blog | 2023-05-25 00:00 | bishopfox.com | original ↗ | #burp-suite | #java | #penetration-testing

13.

New Burp Suite API: we want your feedback!

blog | 2022-12-08 10:45 | portswigger.net | original ↗ | #burp-suite | #java | #roadmap

14.

Jetty Features for Hacking Web Apps

research | 2022-09-15 14:14 | swarm.ptsecurity.com | original ↗ | #rce | #java | #waf-bypass

15.

CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability

vulnerability | 2022-03-23 07:17 | CVE-2022-22947 | blog.viettelcybersecurity.com | original ↗ | #cloud | #rce | #zero-day

16.

Log4j Vulnerability Activity on the HackerOne Platform

vulnerability | 2021-12-13 19:50 | CVE-2021-45046 | hackerone.com | original ↗ | #bug-bounty | #zero-day | #vulnerability-management

17.

Log4Shell, The Worst Java Vulnerability in Years

vulnerability | 2021-12-13 00:00 | CVE-2021-44228 | bugcrowd.com | original ↗ | #rce | #supply-chain | #zero-day

18.

Vulnerability discovery in Java applications

vulnerability | 2021-06-23 00:00 | 0xpat.github.io | original ↗ | #java | #sql-injection | #owasp

19.

RMIScout: Safely and Quickly Brute-Force Java RMI Interfaces for Code Execution

blog | 2020-05-26 00:00 | bishopfox.com | original ↗ | #java | #deserialization | #penetration-testing

20.

GadgetProbe: Exploiting Deserialization to Brute-Force the Remote Classpath

blog | 2020-02-17 00:00 | bishopfox.com | original ↗ | #java | #deserialization | #penetration-testing

21.

Obfuscating Java bytecode with LLVM and Epona

research | 2019-09-01 22:00 | blog.quarkslab.com | original ↗ | #java | #reverse-engineering | #obfuscation

22.

Halloween Hacks and How to Avoid Them #SecOps Edition

incident | 2018-10-26 00:00 | bugcrowd.com | original ↗ | #java | #client-side-security | #obfuscation

23.

RCE in JXBrowser JavaScript/Java bridge

research | 2018-03-21 14:07 | portswigger.net | original ↗ | #rce | #java | #portswigger

24.

Introducing Burp Infiltrator

blog | 2016-07-26 15:52 | portswigger.net | original ↗ | #burp-suite | #java | #collaborator

25.

Writing your first Burp Suite extension

blog | 2012-12-13 11:08 | portswigger.net | original ↗ | #burp-suite | #java | #python

26.

Using Burp Extender

blog | 2009-04-08 20:08 | portswigger.net | original ↗ | #burp-suite | #java | #portswigger

27.

[MoBP] Improved memory handling

blog | 2008-11-28 07:37 | portswigger.net | original ↗ | #burp-suite | #java | #portswigger

28.

[MoBP] Burp Extender extended

blog | 2008-11-25 07:12 | portswigger.net | original ↗ | #java | #portswigger | #burp-extender

29.

Null byte attacks are alive and well

blog | 2008-05-05 13:10 | portswigger.net | original ↗ | #java | #web-security | #input-validation