The July 6–9 window is busy on the AI-agent layer, and unlike the last few mornings the top items are genuinely fresh. Leading is a four-CVE langroid batch — three of them Critical — that widens a pattern the framework has been closing one agent at a time: an LLM-authored query handed to a backend with no validation gate in front of it. The headline is CVE-2026-55615 (9.2), where Neo4jChatAgent runs model-generated Cypher unchecked; 0.65.5 fits it with the same allow_dangerous_operations gate that SQLChatAgent got in an earlier fix. Beside it, 9router is the row with nowhere to upgrade to — two credential-theft criticals, one of them a clean 10.0, and no fixed release for either.

Worth your morning

langroid — a July 6 batch, not the June one. This is distinct from the file-read pair that closed in 0.64.0 (last week's digest). The new cluster is four CVEs disclosed together: CVE-2026-55615 (9.2) in Neo4jChatAgent, plus a TableChatAgent eval() sandbox escape (CVE-2026-54769, critical), a SQLChatAgent blocklist bypass (CVE-2026-54760, critical), and a handle_message() tool-call issue (CVE-2026-54771, high). All share the same shape — a query or call the model can shape reaches a backend with the guard missing or incomplete. 0.65.5 is the floor: it adds the allow_dangerous_operations gate (default False) to Neo4j and Arango agents and tightens the rest. If you build on langroid, upgrade and leave that gate off unless a specific agent genuinely needs write access.

9router — the one with no version to jump to. Two separate criticals this window, both from API routes that never check who's calling. CVE-2026-55500 (9.9) exposes full database export and import — every stored credential, API key, and OAuth token — through an unauthenticated settings route, affected through 0.4.71. GHSA-vjc7-jrh9-9j86 (10.0) adds unauthenticated CRUD on provider connections and plaintext key leakage on the stats route, affected ≤ 0.4.41. Neither has a fixed release. This is a different item from the default-JWT-secret bug we tabled July 4 (that one closed in 0.4.45); these stay open. With no patch to apply, the action is the boring one: take any reachable 9router instance off the network, and if one ever faced the internet, rotate every provider key and token it was holding, because you have to assume they walked.

Serena — clean fix, real reach. CVE-2026-49471 (8.3) in the serena-agent coding toolkit: its built-in web dashboard runs an unauthenticated Flask API on a fixed, predictable port, which chains through to command execution on the host running the agent. Fixed in 1.5.2 — upgrade, and don't expose the dashboard port beyond localhost.

Two moderate MCP-server advisories also landed this window and are worth a version bump if you run them: @aborruso/ckan-mcp-server (SSRF via base_url, a bypass of an earlier fix) and ha-mcp (settings and policy routes reachable without auth). Quiet again on the .NET, NuGet, and Angular side — the one candidate, a Scriban mass-assignment advisory, turned out to be a May fix (7.2.2) re-surfacing in the feed, not new.