Xstream

TeamCity — Unauthenticated RCE via Agent Polling Deserialization (CVE-2026-63077) new KEV EPSS 88%CVE-2026-63077webCRITICAL 9.8Patched2026-08-09Jenkins ClassFilter Deserialization Bypass → Arbitrary File Read — CVE-2026-53435 new EPSS 53%CVE-2026-53435webHIGH 9.1Patched2026-07-05