• Apache Storm: a read-only view exposed a write credential
• MariaDB: a table option became command-line syntax
• Hackage: package metadata could run as a browser URL
• OpenEMR: a callback returned a service login token
• OpenEMR: a sort field became SQL syntax
• Samba: a registered name became a shell command
• GeoTools: a second XML parser lost the access limits