NLTK is the morning. Six advisories went up on the project's own repository on Friday — four high, two moderate — and three days later not one has reached the global pip advisory database. The version arithmetic is the part to read twice: four of them close in 3.10.0, and two of them name 3.10.0 as the affected version. Only 3.10.2 clears the set. Behind it, a Traefik authentication bypass that this digest missed on its way through the Go database last week.

Worth your morning

NLTK — six advisories, and the fix version is also an affected version. The batch published August 7 against a library that shipped two releases on the 5th. Four close in 3.10.0: the SSRF guard in validate_network_url() failing open when DNS resolution fails (GHSA-3gqm-fcw5-w839, high), the pathsec enforcement default (GHSA-p3m8-78j2-g5p3, 7.5), the stable FrameNet and NKJP readers building parser paths that leave the corpus root in 3.9.4 (GHSA-568f-pv23-39p4, 5.9), and missing post-download integrity verification in the package downloader, which is older and closes back in 3.9.3 (GHSA-5wp5-5229-5g6q, high).

Two go the other way. GHSA-f833-7jw8-xwrv (7.5) and GHSA-3hhw-38pf-pxj6 (5.5) are symlink resolution reaching outside the corpus root in FramenetCorpusReader and IPIPANCorpusReader, and both are affected from 3.10.0 forward, fixed in 3.10.2. The first is explicitly a bypass of the fix for CVE-2026-54292. The second is the more instructive one: four reader methods convert a PathPointer to a plain string before opening it, so the validation layer is not defeated, it is stepped around. Both 3.10.0 and 3.10.2 went out on August 5, so the window where the fix was the vulnerability lasted an afternoon — but only if you took the second release.

The advisory to read first is the enforcement default. pathsec ships with ENFORCE=False, which means its checks emit warnings rather than raise, and every path-traversal fix layered onto that module over the past six months has been advisory rather than enforced unless you set the flag yourself. This digest covered four NLTK highs on August 1 and noted that the sandbox was advertised and silently not applied on certain paths. That was the narrower version of the story. The wider one is a sandbox whose default posture is to tell you what it would have stopped.

Two operational notes. The visibility gap is real: the newest reviewed NLTK entry in the pip advisory database is still July 31, and that batch was published to the repository on June 11 — fifty days in transit. pip-audit, Dependabot and Safety will call your install clean this morning on all six of these. Check the installed version by hand. And NLTK is rarely a direct dependency — it arrives under tokenizers, evaluation harnesses and older RAG preprocessing chains, so check what resolved it rather than what you asked for.

Separately, CVE-2026-12372 (3.7, low) reached NVD on Saturday and the advisory database as an unreviewed entry this morning. It is a third gap in the same validate_network_url() function — RFC 6598 shared address space, 100.64.0.0/10, which Python's ipaddress module classifies as neither private nor global, so a guard checking is_private lets it through. It names 3.9.4 and the development branch as affected and no fixed version, so 3.10.2 is not confirmed to close it. Low score, and it only matters if URLs reaching NLTK's network helpers come from somewhere you don't control. If they do, that guard has now failed three distinct ways and is not the control to rely on.

Traefik — a route authentication bypass, and we owe you this one late. A batch of Traefik advisories reached the Go advisory database on August 5 and 6, and this digest walked past them. The one worth acting on is GHSA-cxjq-mrr5-89rv (7.8, CVSS 4.0): a ReplacePathRegex middleware capturing a user-controlled path segment can produce an un-normalised replacement path that the backend then normalises into a different route, so a route protected by BasicAuth, DigestAuth or ForwardAuth on a separate router is reachable without credentials. Affected are 2.11.51 and earlier, 3.0.0 through 3.6.22, and 3.7.0 through 3.7.6; fixed in 2.11.52, 3.6.23 and 3.7.7. The advisory notes it is the same class as the earlier StripPrefix fix, where the post-replacement normalisation check was added in one middleware and not the other.

Traefik is not on this digest's tracked list, and it is here on merit rather than by category: it is the ingress in front of a large share of self-hosted AI tooling, and the failure mode is that the authentication middleware in front of your Open WebUI or n8n was not in front of it. The precondition is a specific middleware configuration, not a default, so check whether you use ReplacePathRegex before you treat it as urgent — and then check the version anyway, because the batch had ten other entries.

MCP CVEs, day three. The wave of unreviewed advisories against small MCP servers has not stopped. Yesterday's digest counted twelve; another dozen or so have landed since, including KoboldCPP-MCP-Server, claude-comfyui-mcp, image-gen-mcp, handwriting-ocr-mcp-server, jira-mcp-server, gemsuite-mcp and LudusMCP. Mostly low, a few moderate, all unreviewed, and — as with the first batch — none names a version that fixes it. Nothing has changed about the response: this is inventory work, not patch work, and the question each one asks is whether you keep running a dependency whose maintainer has not answered a filed CVE. Worth noting that the servers now being hit sit closer to model runtimes than the first batch did.

Standing items. The reviewed npm and pip feeds have not moved since Friday — three days of weekend curation gap, so anything that landed over the weekend is still queued rather than absent. The llama.cpp JSON-schema-to-grammar denial-of-service pair (CVE-2026-17500, CVE-2026-17501) is unpatched for a fourteenth day, with PR #25308 still open and untouched since August 3. Keep schema input inside your trust boundary. n8n's seventeen August 5 advisories have still not reached the global npm advisory database on day five — the newest n8n entry there remains July 22 — so check 1.123.69 / 2.33.4 / 2.34.1 by hand. go-git wants 5.19.2 or 6.0.0-alpha.5, re2 wants 1.26.1, Open WebUI wants 0.11.0 with no 0.10.x backport, and Flowise wants 3.1.4. Quiet on the Venicecom side: no NuGet advisory has published since July 31, nothing new for Angular, .NET or Azure landed in the window, and the August servicing release is tomorrow — expect the next digest to be longer. primeng remains archived with no repository that can issue a security fix.