A quiet one. No reviewed advisory has touched a tracked component in the last 48 hours — the newest entries in the npm and PyPI feeds are still Friday's, and those shipped in yesterday's digest. What's left are two items that reached the database more than a week after their fixes went out, and a wave of twelve auto-filed CVEs against small MCP servers that your scanner will find before you do.

Worth your morning

go-git — the GitPython story, in Go. Two advisories, both against v5 ≤ 5.19.1 and v6 ≤ 6.0.0-alpha.4. CVE-2026-71556 (7.1) is worktree operations following symlinks, so a repository can steer writes outside the worktree path and onto Git metadata and configuration files. CVE-2026-71557 (6.3) is reference names reaching filesystem-backed reference storage without validation, with the same result in a smaller blast radius. Both close in 5.19.2 and 6.0.0-alpha.5.

The timing is the operational part. 5.19.2 shipped on July 29; the GHSA entries published on August 7. If you update on any regular cadence you were covered nine days before there was anything to read, and the alert you get this week is describing your past.

This is the same defect family the digest has been tracking through GitPython for two weeks — a library that runs Git against a repository someone else authored, trusting a name or a path it received rather than validating it. Different language, different maintainers, same trust boundary in the same place. It's in scope here for the same reason: go-git is the Git implementation inside Go tooling that clones on your behalf, which now includes a growing share of coding agents, evaluation harnesses and CI helpers. One difference worth noting operationally — it's a Go module, so the npm and PyPI audits that caught GitPython for you won't see this one. govulncheck will.

Twelve MCP CVEs, and nothing to install. Between Saturday and Sunday, twelve advisories landed against small MCP servers — mcp-bridge-api, mcp-pdf-vision, react-analyzer-mcp, slidev-builder-mcp, llm_memory_mcp, context-engine and others in that size class. Ten low, two moderate. Every one carries a CVE identifier. Not one names a version that fixes it.

All twelve are marked unreviewed, which is the status that matters. GitHub hasn't validated the affected ranges, and the entries follow the bulk third-party submission format rather than a coordinated disclosure with the maintainer — these are single-maintainer projects, mostly published in the last year, and in several cases the advisory is the first security artifact the project has.

Treat this as inventory work, not patch work. If you don't run one of these servers, there is nothing here. If you do, the CVE identifier is real and will surface in your dashboard and eventually in someone's vendor questionnaire, but there's no fixed version to move to, so the decision is whether you keep running a dependency whose maintainer hasn't responded to a filed CVE. That's a supply-chain call, and it's the one this category will keep asking you to make: MCP servers are npm and PyPI packages with filesystem and network access by design, and the median one has a single author.

The rest. re2 closes two process-level failures. CVE-2026-71498 (5.1) returns up to three bytes of adjacent heap memory to JavaScript when replace() and split() are handed a Buffer ending in a truncated multi-byte character, fixed in 1.26.1; CVE-2026-71430 (6.2) aborts the Node process outright rather than throwing, fixed in 1.25.1. Go to 1.26.1 and both are behind you. Modest scores, but check whether you have it before you skip it — re2 is almost always transitive, pulled in as the ReDoS-safe regex engine under something else, which means the code depending on it is code that already decided regular expressions were a risk worth engineering around.

Standing items. The llama.cpp JSON-schema-to-grammar denial-of-service pair (CVE-2026-17500, CVE-2026-17501) is unpatched for a thirteenth day, with PR #25308 still open and untouched since August 3 — the maintainer has said the fix looks correct, and the discussion is now about severity rather than code. Keep schema input inside your trust boundary. n8n's seventeen August 5 advisories have still not reached the global npm advisory database on day four; the newest n8n entry there remains July 22, so npm audit and Dependabot will still call your install clean, and you still have to check 1.123.69 / 2.33.4 / 2.34.1 by hand. Open WebUI wants 0.11.0 with no 0.10.x backport, and Flowise wants 3.1.4. Quiet on the Venicecom side: no NuGet advisory has published since July 31, nothing new for Angular, .NET or Azure landed in the window, and the August servicing release is Tuesday the 11th. primeng remains archived with no repository that can issue a security fix.