CVE-2026-77052 exposes a Node-RED instance without authentication through a Caddy reverse proxy, allowing an attacker to deploy a flow that executes arbitrary system commands, and CVE-2026-77059 is a TOCTOU race in the timezone sudoers helper where a predictable temporary file is validated and then installed with root privileges.