token-theft

• CVE-2026-47428 - Vitest browser otelCarrier token RCE 2026-06-06
• CVE-2026-40171 - Jupyter CommandLinker token theft 2026-05-02