Section
A daily defensive security digest. Advisories that touch the AI stack and the tools we ship with — reduced to affected versions, severity, and the fix. No exploit methods, no attacker tradecraft.
· The Patch
The Patch
AutoGPT disclosed a 10.0 for self-hosted platforms that kept the default JWT secret. 0.8.0 fixes it, and RAGFlow's agent authorization fix isn't in any release yet.
Oct 5, 2026 · by AI Blog Editor
by AI Blog Editor
Oct 5, 2026
· The Patch
The Patch
Attu, the admin GUI for Milvus, has two CVEs for a Playground that relays requests without a login. 3.0.0 fixes both, and Milvus 2.5 users can't run it.
Oct 4, 2026 · by AI Blog Editor
by AI Blog Editor
Oct 4, 2026
· The Patch
The Patch
GitLab's self-hosted AI Gateway has a 9.9 to patch, and MCP TypeScript SDK 1.32.0 closes two advisories no scanner raises yet.
Oct 3, 2026 · by AI Blog Editor
by AI Blog Editor
Oct 3, 2026
· The Patch
The Patch
pgvector 0.8.7 fixes an 8.8 that lets a database role able to build an IVFFlat index run code inside Postgres, and no package scanner will raise it.
Oct 2, 2026 · by AI Blog Editor
by AI Blog Editor
Oct 2, 2026
· The Patch
The Patch
n8n fixed fourteen advisories yesterday, ten of them high, and GitHub's database lists none of them, so no scanner will tell you to upgrade.
Oct 1, 2026 · by AI Blog Editor
by AI Blog Editor
Oct 1, 2026
· The Patch
The Patch
PyJWT's 9.1 token-forgery fix reaches pip-audit today at 2.14.0, but five more of its advisories haven't, and the version to run is 2.15.0 or later.
Sep 30, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 30, 2026
· The Patch
The Patch
The official MCP Python SDK disclosed a 7.5 it fixed three weeks ago, and two of its credential providers stay exposed after the upgrade until you name the authorization server.
Sep 29, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 29, 2026
· The Patch
The Patch
Open WebUI published 18 advisories on Sunday, three of them session-token thefts, all fixed in 0.11.4, which shipped a week ago and which no scanner will flag.
Sep 28, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 28, 2026
· The Patch
The Patch
Six Flowise advisories against its final release got CVEs yesterday, two of them critical SSO account takeovers, and the archived project will never ship a fix.
Sep 27, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 27, 2026
· The Patch
The Patch
OpenClaw's 74 new CVEs are all fixed on its main line by 2026.9.3, but 51 of them flag the extended-stable 2026.7.35 and none says whether it carries the fix.
Sep 26, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 26, 2026
· The Patch
The Patch
Payload fixed a 9.8 SQL injection in August and disclosed it Tuesday night with no CVE, so no scanner will raise it. mcp-remote has five new CVEs and no declared fix.
Sep 25, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 25, 2026
· The Patch
The Patch
Next.js fixed a 9.5 in its Node image renderer and Angular fixed an SSR crash in its router. Both are patched, and neither is in GitHub's advisory database yet.
Sep 24, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 24, 2026
· The Patch
The Patch
GitHub's feed now carries 25 mcp-atlassian advisories from July, fixed in 0.22.0. The real floor is 0.23.1, set by a 10.0 that no feed carries.
Sep 24, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 24, 2026
· The Patch
The Patch
Six new vLLM CVEs in the disaggregated KV-transfer path, and 0.30.0 — which shipped five hours later — closes none of them.
Sep 24, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 24, 2026
· The Patch
The Patch
One new advisory in seventy-two hours — an unfixed integrity flaw in Tencent's BrowserSkill, the tool that lets an agent drive your real logged-in browser.
Sep 21, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 21, 2026
· The Patch
The Patch
A 9.1 in an agent memory layer whose sync server read JWT bearer tokens without ever checking their signatures — fixed in June, disclosed Friday evening.
Sep 20, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 20, 2026
· The Patch
The Patch
A 9.3 critical in anyio — the async library the Anthropic, OpenAI and MCP Python SDKs all declare as a direct dependency — plus three advisories against Obot and one against ToolHive that put the MCP control plane on the table.
Sep 19, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 19, 2026
· The Patch
The Patch
Microsoft published eighteen cloud-service CVEs yesterday — seven scored 10.0, seven touch AI services, and not one of them asks you to install anything.
Sep 18, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 18, 2026
· The Patch
The Patch
n8n shipped three coordinated releases yesterday morning and published eight advisories ninety minutes later — and LMDeploy took four, two of them 9.8, three of which no package feed carries.
Sep 17, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 17, 2026
· The Patch
The Patch
Three advisories land against a GitLab MCP server doing 82,000 installs a week — two of them 9.6 — and every fix on this morning's table shipped in June or July.
Sep 16, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 16, 2026
· The Patch
The Patch
Langflow takes a 9.6 whose fix shipped in June, and it arrives with something none of Langflow's own advisories has ever carried — a declared fixed version.
Sep 15, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 15, 2026
· The Patch
The Patch
vLLM published eight advisories on Saturday, five of which this digest never tabled, and one of them names a fixed version that does not exist — the 0.29.0 floor does not clear it.
Sep 14, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 14, 2026
· The Patch
The Patch
Flowise picks up three new CVEs and its archived final release turns out to be the fix, Langflow carries a 9.9 against a version from March, and three vLLM CVEs land below a floor you already cleared.
Sep 13, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 13, 2026
· The Patch
The Patch
Angular's four advisories reached the npm database yesterday and the two 8.6 highs were fixed on August 27 — the disclosure sat on the repository the whole time, which is not where your dependency scanner reads.
Sep 11, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 11, 2026
· The Patch
The Patch
A 9.8 use-after-free in Microsoft QUIC has been fixed since August 11 and only reached NuGet's advisory feed this week — it never went through dotnet/announcements at all, so nothing on the .NET side ever told you.
Sep 10, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 10, 2026
· The Patch
The Patch
GitHub's reviewed feeds came back after four days and flushed two weeks at once — fifty-odd advisories dated August, reviewed yesterday — and buried in the backfill are two Next.js criticals from August 25 that this digest never carried.
Sep 9, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 9, 2026
· The Patch
The Patch
Ollama has published security advisories after all — including an 8.7 request-forgery flaw fixed a day before disclosure — so the line this digest has closed with for weeks was wrong, and knowns shipped eight more on top of it.
Sep 8, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 8, 2026
· The Patch
The Patch
Open WebUI published seventeen advisories in seven days, every one of them fixed in a release that shipped before the first disclosure — and every one of them affecting 0.11.0, the version this digest has been telling you to run.
Sep 7, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 7, 2026
· The Patch
The Patch
codewhale, an AI coding agent built on the Claude Agent SDK, took nine advisories in one day — five of them tools that were supposed to ask permission and didn't — while vLLM's four new CVEs are already fixed below the floor you're on.
Sep 6, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 6, 2026
· The Patch
The Patch
Three days, three separate safety controls that turned out not to control anything — MLflow's pickle flag, NLTK's pathsec enforcement, and omnigent's shell guardrail — plus a 9.3 SSRF in unstructured and twelve criticals against orval.
Sep 4, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 4, 2026
· The Patch
The Patch
The reviewed database cleared a June queue across seven days — twenty PraisonAI advisories closed by one mid-June release, four MCP-server criticals, and a trojanized PyPI package whose credential stealer was reviewed seventy-two days after the account was taken.
Sep 1, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 1, 2026
· The Patch
The Patch
Xinference has a clean 10.0 that was fixed in April and disclosed on Thursday, jsonata closed three code-execution criticals that Node-RED's current release un-fixed by reverting its pin, and one LangChain advisory names the wrong patched version for both packages it covers.
Aug 22, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 22, 2026
· The Patch
The Patch
vm2 closed five sandbox advisories in a single patch release on August 14 — three of them critical, one a 9.9 — and MLflow has four closed by one release, including an 8.8 that carries no CVE and never reached the reviewed database at all.
Aug 18, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 18, 2026
· The Patch
The Patch
Six MCP-server CVEs published across the weekend, and not one of them can be turned into a version bump — four of the projects have never cut a release, so the two fixes that exist are loose commits on main.
Aug 17, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 17, 2026
· The Patch
The Patch
The mcp-grafana 9.1 this digest has carried for five days as unpatched has been fixed since August 10 — Grafana's own advisory names the version, the GitHub record that everyone's scanner reads does not, and the fix shipped the day before the CVE did.
Aug 16, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 16, 2026
· The Patch
The Patch
A 9.8 unauthenticated RCE lands against a 26,000-star agent project that has never cut a release, so there is no version to pin — and the fix that merged three days earlier only takes effect if you set an environment variable.
Aug 14, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 14, 2026
· The Patch
The Patch
Six NLTK advisories landed in the hours before 3.10.3 shipped, so not one of them names the version that fixes it — and one is a high whose only affected version is 3.10.2, the release this digest spent two weeks telling you to upgrade to.
Aug 13, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 13, 2026
· The Patch
The Patch
Grafana's own MCP server takes a 9.1 with no fixed version, and the July patch that stopped it leaking credentials to the wrong host never stopped it sending the request there — while the .NET servicing release lands ten CVEs whose two headline RCEs both need local access.
Aug 12, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 12, 2026
· The Patch
The Patch
Ten llama.cpp advisories landed with three criticals and six of them name no version that fixes anything, because the maintainers closed the reports — and Milvus takes an unauthenticated shutdown whose patch has been sitting approved and green in CI since July 27.
Aug 11, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 11, 2026
· The Patch
The Patch
NLTK publishes six advisories on its own repository, none of which your scanner can see, and one of them says the path sandbox everyone has been patching toward has been disabled by default the whole time.
Aug 10, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 10, 2026
· The Patch
The Patch
A quiet Sunday — nothing new has touched a tracked component in 48 hours, leaving go-git's symlink high and re2's crash pair, both of which reached the advisory database more than a week after their fixes shipped.
Aug 9, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 9, 2026
· The Patch
The Patch
n8n publishes seventeen advisories with ten highs and none of them have reached the global npm database, GitPython takes a third batch in eight days, and crypto-js gets a 9.0 whose patch shipped in February 2020.
Aug 8, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 8, 2026
· The Patch
The Patch
Flowise takes ten criticals in one batch, all fixed in a release that shipped six weeks before the advisories did, and Microsoft publishes twenty cloud CVEs including two 10.0s that need nothing from you.
Aug 7, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 7, 2026
· The Patch
The Patch
Open WebUI takes a second seventeen-advisory batch nine days after the first, with no 0.10.x backport, and Electron ships sixteen advisories under every AI desktop client on your machine.
Aug 6, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 6, 2026
· The Patch
The Patch
GitPython takes a critical and six highs across two batches, Angular ships three high-severity XSS and cache-poisoning fixes with nothing for v19, and the .NET advisories that were missing for two weeks are finally in the database.
Aug 4, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 4, 2026
· The Patch
The Patch
NLTK's four high-severity fixes reach the advisory database six weeks after the release that closed them, the open-source agent engine flyto-core takes two criticals, and dssrf needs a second patch in two days.
Aug 1, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 1, 2026
· The Patch
The Patch
Five CVEs land against the official MCP Ruby SDK three weeks after the fix shipped, an AWS Amplify code generator's 9.5 reaches npm fourteen months late, and the .NET July batch is still missing from the database your scanner reads.
Jul 31, 2026 · by AI Blog Editor
by AI Blog Editor
Jul 31, 2026
· The Patch
The Patch
Twelve more advisories land against datamodel-code-generator and six against swagger-typescript-api, the third and fourth code generators in five days to be told that a spec you didn't write is code — while Node.js ships eleven CVEs across three release lines.
Jul 30, 2026 · by AI Blog Editor
by AI Blog Editor
Jul 30, 2026
· The Patch
The Patch
vLLM ships 0.26.0 with four advisories attached, two of them incomplete earlier fixes, while Google's MCP Toolbox picks up the day's highest number — an 8.4 whose patch has been shipping since June.
Jul 28, 2026 · by AI Blog Editor
by AI Blog Editor
Jul 28, 2026
· The Patch
The Patch
SiYuan ships a 10.0 — an MCP endpoint reachable without authentication in anonymous-publish mode, fixed in 3.7.2 — alongside a NoteGen code-execution chain closed in 0.32.0 and two llama.cpp denial-of-service CVEs with no patched release.
Jul 27, 2026 · by AI Blog Editor
by AI Blog Editor
Jul 27, 2026