project
Open-source geospatial server for publishing map and feature data; the software containing the disclosed jsonArrayContains SQL injection.
A researcher published a GeoServer SQL injection on 12 August 2026 and watchTowr says probing started within hours. With no fix shipped, access control is the only lever available.
Reality
GeoNetwork's fix shipped 54 days before anyone explained what it fixed. Ethiack puts 121 exposed vulnerable catalogs across 39 countries, nearly nine in ten of them government, military or national-agency systems.
Reality
VulnCheck says SPEAKINGSTONE beacons as root over cleartext UDP with no authentication. Control passes to anyone who occupies that channel, and a second implant in the same firmware image turned up in 22 countries.
Reality
DailyMeteo serves 11 TB of GeoTIFFs from a Django app reading files off a disk. The load-bearing choices are a dedicated production box and a pull-based rsync every 30 minutes.
Reality
Hundreds of exploit attempts landed within hours of public disclosure, according to WatchTowr. With nothing to install, the controls available are network isolation, filter-layer blocking and least privilege.
Reality