Escaping a Python jail using an MD5 collision
Turning a boring file move into a privilege escalation on Mac
Escaping Parallels Desktop with Plist Injection
Exploiting a Use-After-Free for code execution in every version of Python 3