A 10.0 is this morning's headline, and it arrives through an MCP endpoint. SiYuan — the self-hosted notes app a lot of this audience runs beside a local model — exposes its POST /mcp kernel route behind a permission check that confirms you are someone and never asks which someone. In one supported configuration that's reachable with no authentication at all. Fixed in v3.7.2. Underneath it, NoteGen closes a two-CVE chain that starts with rendering model output as live markup, and llama.cpp picks up two denial-of-service CVEs whose fix is still an open pull request.

Worth your morning

SiYuan — the MCP route with no role check. CVE-2026-66012 (10.0) is a missing-authorization flaw in the POST /mcp kernel endpoint. It's gated by a general authentication check with no admin-role or read-only enforcement, and it fronts 31 MCP tools — including a file tool carrying list, read, write, delete, rename and copy across the entire workspace. What turns that from a privilege problem into an unauthenticated one is the Publish server: with Publish.Enable=true and Publish.Auth.Enable=false — the supported anonymous mode for public documentation sites — the publish reverse proxy attaches an anonymous reader token to every request it forwards, and /mcp accepts it. The advisory puts the impact at workspace read and write, plaintext recovery of accessAuthCode, api.token and cookieKey from conf/conf.json, and administrator takeover on the next desktop launch by way of arbitrary file write into the plugin directory. Fixed in v3.7.2; v3.7.3 has been out since July 21. If you publish a SiYuan workspace publicly, upgrade this morning and confirm whether anonymous publish is on.

NoteGen — two CVEs, one release. CVE-2026-17496 (8.1): the desktop app renders AI chat responses as raw HTML — markdown-it with html:true, injected through dangerouslySetInnerHTML, no sanitizer, CSP null — so markup that reaches the model prompt and comes back in a response runs as script inside the privileged Tauri webview. CVE-2026-17497 (8.3) is what makes that expensive: the default desktop capabilities grant the Tauri shell plugin shell:allow-execute for bash, python and python3 with arbitrary arguments, so script in that webview can run OS commands as the NoteGen process. Chained, the advisory rates it full remote code execution on the user's machine. Both close in 0.32.0, and 0.32.1 shipped July 21.

llama.cpp — two filed, nothing to upgrade to. CVE-2026-17500 and CVE-2026-17501 (both 5.3 under CVSS v3, 6.9 under v4) sit in common/json-schema-to-grammar.cpp, the converter that turns a JSON schema into the GBNF grammar behind constrained output. One is a null-pointer dereference, the other unbounded resource allocation. Both are availability-only — a crash or a memory blow-up, no read or write of your data — and both are reachable by whoever supplies the schema. There is no patched build: the hardening PR (#25308) has been open since July 4 and was still open at time of writing, so today's b10144 carries the same code. Until it merges, treat schema input as a trust boundary — don't accept json_schema or response_format payloads from callers you don't control, and keep llama-server off open networks.

Also on the pip side: datamodel-code-generator CVE-2026-63720 (7.5) emits a value carried in an input schema straight into a generated from … import … statement without identifier validation, so a schema you didn't write can execute Python when the generated module is imported. Anyone generating Pydantic models from third-party OpenAPI or JSON Schema should move to 0.70.0; 0.71.0 is current. Quiet elsewhere: GitHub's reviewed-advisory feed published nothing across the weekend, and nothing new has cleared the bar on Angular, PrimeNG, .NET, NuGet, or Azure since July's servicing release on the 14th.