Flowise is the morning: ten criticals and five highs in one batch, topping out at 9.5, every one of them fixed in 3.1.3 — a release that went out on June 25, six weeks before the advisories describing it. If you last updated in April you are on 3.1.2 and you have all fifteen. Behind it, pdf.js takes an 8.6 that lands twice, once in pdfjs-dist and once in the Angular viewer that bundles it. And Microsoft published twenty cloud-service CVEs this morning, two of them 10.0, with customer action required on none.

Worth your morning

Flowise — fifteen advisories, and the patch is older than the disclosure. The batch went up Monday: ten criticals between 9.2 and 9.5, five highs between 7.1 and 8.3, and a couple of moderates behind them. Ten of the criticals are code execution on the host running Flowise, reachable through the CSV agent node, the Pyodide and NodeVM code-execution nodes, the SQLite record manager, and a TypeORM data source. The eleventh angle is CVE-2026-70478 (9.2), which is the one to read first because it needs no account at all: an unauthenticated OAuth2 token-refresh endpoint returned access tokens for connected services, so every integration you wired into a chatflow is in scope.

The highs are a set: cross-workspace credential leakage through the OpenAI assistants vector store (CVE-2026-70472, 7.1) and OAuth2 credential metadata (CVE-2026-70474, 7.6), server-wide upsert history returned to any caller (CVE-2026-70473, 8.3), and missing authorization on the execution update endpoint (CVE-2026-70475, 7.1). Multi-tenant Flowise was one tenant.

Everything in the batch closes in 3.1.3 except the text-to-speech credential-abuse item (GHSA-8gj2-2cvc-6xx7, 6.3), which is affected through 3.1.3 and fixed in 3.1.4. Go to 3.1.4 and you clear the whole set.

The version arithmetic is the part that matters operationally. 3.1.2 shipped April 14, 3.1.3 on June 25, 3.1.4 on July 29. Anyone on a normal update cadence was already covered before Monday and doesn't know it; anyone who stood up Flowise in the spring and left it running is four months and ten criticals behind. This is self-hosted visual agent tooling — it tends to live on an internal box that someone spun up for a demo, with real API keys in it, and no one owns the upgrade. Check what version yours is on before you decide this doesn't apply to you.

pdf.js — one CVE, two packages, and it probably reaches you twice. CVE-2026-16633 (8.6) is arbitrary JavaScript execution when a malicious PDF is opened, affecting pdfjs-dist from 5.6.83 up to 6.2.108. The same day, GHSA-w9hm-4m3m-fxmm (8.6) landed against ngx-extended-pdf-viewer for bundling an affected copy, fixed in 29.0.0-rc.3.

Two separate exposures worth checking separately. On the Angular side it's a viewer rendering documents users upload, which is the direct path. On the AI side, pdfjs-dist is the default text extractor under a lot of document-ingestion code — LangChain's PDFLoader, most RAG starter kits, anything that turned a PDF into chunks. That path is easy to forget because nobody is looking at the PDF; a pipeline is. If your corpus includes documents you didn't author, the parser is a trust boundary.

Twenty Microsoft cloud CVEs, and nothing to do. The August early-release batch is unusually loud on paper: CVE-2026-56162 in Azure SQL Database and CVE-2026-65667 in Teams both scored 10.0, with Azure Service Bus, Azure Active Directory, Entra Provisioning and Azure SRE Agent at 9.9. The SharePoint 9.6 is SharePoint Online only — no on-premises Server build is listed as affected.

All twenty carry the same MSRC note: fully mitigated by Microsoft, no action for users of the service. These are published under the Cloud Service CVE transparency program, which assigns identifiers to issues Microsoft fixed in its own infrastructure so they show up in the record rather than nowhere. Worth knowing because the numbers will surface in SCA dashboards and vendor questionnaires over the next fortnight looking like an emergency, and the correct response is to cite the MSRC note and move on. Confirm the version you run is the service and not a self-hosted equivalent, and you're done.

The rest. nx CVE-2026-71476 (8.7) is a Zip-Slip in self-hosted remote cache extraction — file write outside the cache directory when an artifact is unpacked. It only bites if you run the self-hosted cache packages rather than Nx Cloud, but a build cache is shared infrastructure and a poisoned entry reaches every developer who pulls it. Fixed in 22.7.7 and 23.0.2. js-yaml GHSA-5p4m-2wfm-xmqj (7.5) is quadratic CPU in !!omap resolution; it's a high because js-yaml parses config in roughly everything, and the question is whether any of it parses YAML you didn't write. mermaid takes five — the worst a 6.5 prototype pollution in architecture diagrams — which matters here because mermaid renders model output in chat UIs, so the input is untrusted by construction. Fixed in 11.16.1 and 10.9.8.

Two smaller ones. langgraph-checkpoint-postgres and -sqlite CVE-2026-71433 (5.3): namespace prefix matching crossed segment boundaries, so a scoped read of users/alice also returned users/alicia. Low score, but if you're using namespaces as the isolation boundary between agent sessions or tenants, that boundary was approximate. Fixed in 3.1.1. And h2 CVE-2026-71554 (5.3) accepted header blocks with more than one Host header, which becomes request smuggling on downgrade to HTTP/1.1 — fixed in 4.4.1, and it arrives under httpx, which arrives under most of the Python AI SDKs.

Standing items. The llama.cpp JSON-schema-to-grammar denial-of-service pair (CVE-2026-17500, CVE-2026-17501) is unpatched for an eleventh day, with PR #25308 still open and last touched August 3. Keep schema input inside your trust boundary. Yesterday's Open WebUI batch still wants 0.11.0 and there is no 0.10.x backport coming. primeng remains archived with no repository that can issue a security fix.