This morning the action moves off the MCP wrappers and onto the runtime. vLLM — the inference server plenty of you run behind a local model — lands a cluster of advisories that all close in 0.24.0: a ReDoS in the structured-outputs regex path (8.7) and a remote DoS via invalid-token reinjection (7.5), plus two moderates. Below it, meta-ads-mcp patches two highs at once in 1.0.115 — an SSRF in its image-upload tool (8.3) and an auth-bypass that falls back to the operator's Meta token (7.4), the familiar MCP-server pair of reaching where it shouldn't and trusting a header it shouldn't. Prompty rounds out the table as a version check: a high-severity code-exec in its .prompty frontmatter loader, fixed back in June, only now in GitHub's reviewed feed. Everything here has a fixed release.

Worth your morning

vLLM — the runtime, not a wrapper. CVE-2026-55574 (8.7) is a ReDoS: the structured-outputs regex path compiles a caller-supplied pattern without a timeout in the xgrammar and outlines backends, so a crafted schema can pin a worker. CVE-2026-54234 (7.5) is a remote DoS in the token-recovery path, affecting 0.17.1 through 0.23.x. Two moderates ride the same release — a differential in multi-channel audio downmixing and a speech-to-text upload limit that's only enforced after the full read. All four close in 0.24.0. These are availability bugs, not RCE, but if you serve vLLM to anything you don't fully trust, 0.24.0 is today's upgrade.

meta-ads-mcp — two ways in, one fix. CVE-2026-54549 (8.3) is an SSRF in the upload_ad_image tool: an unvalidated image_url reaches an HTTP fetch, so it can be pointed at localhost, RFC 1918 space, or a cloud metadata endpoint. CVE-2026-54547 (7.4) is an auth-bypass — a request carrying the X-Pipeboard-Token header slips the guard and falls back to the operator's META_ACCESS_TOKEN, so tool calls run with your Meta Ads credentials. Both close in 1.0.115. If you expose this server over HTTP, upgrade; and if an exposed version ran against your ad account, treat the operator token as one to rotate.

Prompty — reviewed now, fixed in June. CVE-2026-53597 (8.7) is a code-injection in the .prompty frontmatter loader, which parsed JavaScript in a field meant to hold YAML; a companion file-read (CVE-2026-53598, 7.5) let a frontmatter file reference escape its directory. Both hit the 2.0 pre-release across npm (@prompty/core), PyPI (prompty), NuGet (Prompty.Core), and crates — the fix landed in early June (npm 2.0.0-beta.3 clears both), and GitHub only pulled the advisories into its reviewed feed on the 17th. A version check, unless you pin to a 2.0 beta.

Quiet on the .NET, NuGet, Azure, and Angular side — July's servicing release (the 14th) is in the last digest, and nothing new has cleared the bar since.