MLJAR mercury

• CVE-2026-111059 Medium 6.1 Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML 0.3%
• CVE-2026-111058 Critical 9.8 Mercury: Unauthenticated Remote Code Execution via /api/kernels 0.5%
• CVE-2026-111057 Critical 10.0 Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass 0.7%