Two quiet mornings in a row. The last 24 hours weren't short on disclosures — they were short on disclosures that touch anything we track. The reviewed feed's headline items were a pair of pre-auth criticals in OpenAM (the Java identity server), a long batch of authorization and multi-tenancy fixes in Snipe-IT (PHP asset tracking), and an overnight wave of unreviewed CVEs across Quest NetVault Backup and the Rapid7 InsightConnect plugins. Nothing landed on the local model runtimes, the LLM frameworks, the MCP servers, or the .NET, NuGet, and Angular side. The AI items the news feeds are still circulating — the vLLM video-processing batch, Ollama's GGUF loader, the LangChain serialization CVEs — are all weeks to months old and shipped here or upstream long ago.

Still open

The one thread worth a second glance is yesterday's: the June 21 LiteLLM proxy-auth CVE cluster (the CVE-2026-127xx series) still has no matching advisory from LiteLLM's own repository, and the version ranges in the CVE titles still trace to a third-party vulnerability feed rather than a release note. The read hasn't changed — if you run the gateway, confirm you're on a current stable build well past the cited ranges and that the proxy's auth surface isn't exposed to anything it shouldn't be. Nothing new to act on beyond that. A real all-clear is information, and that's what this is.