Loading story…
ProjectDiscovery added a Nuclei template for CVE-2024-27198, an authentication bypass affecting JetBrains TeamCity versions earlier than 2023.11.4. The template is intended to help defenders identify exposed TeamCity servers vulnerable to unauthorized access, a flaw that drew broad attention because it can allow attackers to reach administrative functionality without valid credentials.
The related references also show ongoing community work to operationalize and remediate disclosed vulnerabilities across the ecosystem, including a GitHub pull request to fix a path traversal issue in BeehiveInnovations' pal-mcp-server, a Nuclei template contribution for CVE-2023-40044, and Google security research updates for kernelCTF CVE-2024-50264. Together, the activity reflects active publication of detection content, exploit research, and code fixes for high-impact flaws spanning enterprise software, open-source applications, and the Linux kernel.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
BeehiveInnovations opened pull request #353 to fix a path traversal vulnerability in the pal-mcp-server function is_dangerous_path(). The change reflects a remediation step for the identified flaw.
Google's security-research repository published a pull request adding a kernelCTF entry for CVE-2024-50264_lts_cos. This marks public technical documentation or research material related to the kernel vulnerability.
A ProjectDiscovery nuclei template pull request was opened to detect CVE-2024-27198, an authentication bypass affecting TeamCity versions earlier than 2023.11.4. This indicates public technical detection content for the vulnerability became available.
A ProjectDiscovery nuclei-templates pull request was published to add detection coverage for CVE-2023-40044. This represents public release of scanning logic for the vulnerability.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **CVE-2026-63077** to its Known Exploited Vulnerabilities catalog, raising the total number of listed flaws from 1660 to 1661. The vulnerability affects **JetBrains TeamCity** and is described as a deserialization of untrusted data issue that could allow **unauthenticated remote code execution** through the TeamCity agent polling protocol. CISA mapped the flaw to **`CWE-502`**, said known ransomware use is currently unknown, and directed organizations to apply vendor mitigations and follow **BOD 26-04** and forensic triage guidance. Public defender activity followed quickly, with a **Nuclei** template pull request opened for **CVE-2026-63077** covering TeamCity versions earlier than **2026.1.3** and **2025.11.7**. The repository activity showed the detection template moving through review and merge workflow, indicating that scanning coverage for the newly cataloged, exploited TeamCity flaw was being prepared as organizations faced a CISA remediation due date of **2026-08-08**.
Aug 7, 2026
ProjectDiscovery contributors submitted new Nuclei detection templates for two newly tracked vulnerabilities: **`CVE-2025-27364`**, described as an **unauthenticated remote code execution** flaw in **MITRE Caldera**, and **`CVE-2025-25291`**, an **authentication bypass** issue in **`ruby-saml`** affecting **GitLab SAML SSO** deployments. The references indicate both issues were significant enough to prompt rapid addition of scanning coverage in the public `nuclei-templates` repository. Available details remain limited because the source material is drawn from GitHub pull request metadata rather than full advisories, but the vulnerability labels point to potentially high-impact exposure in identity and adversary-emulation infrastructure. Security teams using **GitLab SAML single sign-on** or **MITRE Caldera** should track vendor guidance, validate exposure to **`CVE-2025-25291`** and **`CVE-2025-27364`**, and prepare to use updated detection content as part of vulnerability assessment workflows.
Jun 29, 2026
ProjectDiscovery contributors opened and advanced Nuclei template pull requests for two newly tracked vulnerabilities: **`CVE-2026-4257`**, a **server-side template injection** issue in the **WordPress Contact Form by Supsystic** plugin, and **`CVE-2026-33032`**, a **broken access control** flaw in **Nginx UI**. The GitHub activity shows template development intended to support detection of both issues, with one pull request referencing a new `CVE-2026-4257.yaml` file and another marked ready to merge for the Nginx UI vulnerability. The available records are limited to repository metadata and do not include technical write-ups, affected version ranges, exploitation details, or vendor remediation guidance. Even so, the publication of detection content for these CVEs indicates that security researchers are operationalizing checks for exposed systems, and defenders using Nuclei should watch for template releases covering both the WordPress plugin SSTI and the Nginx UI authorization weakness.
Jun 29, 2026