Marimo CVE-2026-39987 exploited within 10 hours of disclosure, enabling unauthenticated RCE and credential theft, emphasizing urgent patching needs.
Strapi plugins exploit Redis and PostgreSQL via postinstall scripts, enabling persistent access and data theft.