lichess-org lila

• CVE-2026-103974 Medium 5.4 lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies 0.2%
• CVE-2026-35208 Medium 5.3 lichess.org has an Unsanitized Stream Title Injection on /streamer 0.3%