oraios serena

• CVE-2026-109965 High 7.1 Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root 0.2%
• CVE-2026-49471 High 8.3 Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE 0.4%