cors

• CVE-2026-44895 - GitLab MCP Server SSE auth bypass 2026-06-09
• GHSA-6xcp-7mpr-m7wm - Open WebUI CORS and session RCE chain 2026-05-12