file-write

• CVE-2026-27905 - BentoML tar symlink arbitrary write 2026-06-08
• CVE-2026-40576 - excel-mcp-server path traversal 2026-06-07
• CVE-2026-47731 - AIT-Core BSC path traversal file append 2026-06-07