SSTI in Nunjucks and SUID capability on Perl
Friendly PHP insecure deserialization attack and race condition