# ZAP gets on the bug train

**URL:** <https://taggartinstitute.org/t/zap-gets-on-the-bug-train/727>\
**Category:** Cyber News\
**Tags:** web, zaproxy\
**Created:** [June 24, 2026, 3:44pm UTC](https://taggartinstitute.org/t/zap-gets-on-the-bug-train/727 "2026-06-24T15:44:39Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mttaggart](https://taggartinstitute.org/user_avatar/taggartinstitute.org/mttaggart/32/10_2.png) [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Post date:** [June 24, 2026, 3:44pm UTC](https://taggartinstitute.org/t/zap-gets-on-the-bug-train/727/1 "2026-06-24T15:44:39Z")

</div>

See? It really can do everything Burp can do.

> **[Java Deserialization Vulnerability in ZAP Viewstate Add-on](https://www.zaproxy.org/blog/2026-06-24-java-deserialization-vulnerability-in-zap-viewstate-addon/)**
>
> A Java Deserialization Vulnerability has been found in the ZAP Viewstate Add-on. Update your ZAP add-ons now, and if you are on an older version of ZAP then update that ASAP.