Unauthenticated GeoNetwork RCE, plus upload/SSRF/XSS trivia and the Spring/XSLT chain that makes it happen.

Cloudflare’s writeup of a renewed remote Spectre attack on Workers, plus the mitigations they bolted on afterward.

Authenticated SQLi in AppFlowy's quick-note, with a user `search_term` spliced into SQL and cloud vs self-hosted patch drift.