llama.cpp is the morning, and there is nothing to install. Ten advisories reached the GitHub database on Thursday and Friday — three critical, five high — and six of them name no version that fixes them, because the reports were closed without fixes and the patch pull request was closed without merging. Behind it, Milvus takes an unauthenticated component shutdown whose fix has been approved and passing CI since July 27, and which the August 4 release shipped without.

Worth your morning

llama.cpp — ten CVEs, and the vendor's answer is the threat model. The batch published August 6 and 7, filed by Cyera Research through VulnCheck rather than through the project, and all ten are marked unreviewed. Six carry no fixed version.

Three are critical, all 9.2. CVE-2026-43629 is an integer overflow in KV cache state restoration reaching a heap buffer overflow, against builds b4882 through b9058, and it needs write access to the slot save directory. CVE-2026-43631 and CVE-2026-43632 are both use-after-free through a race in llama-server — the vocab pointer and the tokenization endpoints — against b7492 through b9060, and both require --sleep-idle-seconds to be set. That flag is the precondition worth checking first, because it is not a default and it is exactly what you turn on when you are running a model server that idles.

The other three unfixed ones: CVE-2026-43627 (8.5), an integer overflow in llama_batch_init() against b1283 forward — the longest range in the batch, roughly two years of builds; CVE-2026-43628 (8.5), an integer underflow in the DRY sampler that ends in an out-of-bounds read, so a crash or silently wrong sampling probabilities; and CVE-2026-43630 (6.3), a heap read leak in the recurrent memory state restore path, again gated on write access to the slot directory.

The four against the Android JNI wrapper are the ones with somewhere to go — CVE-2026-43622 (8.5, a double free from malloc() memory released with delete), CVE-2026-70638 (8.5), CVE-2026-70640 (7.3) and CVE-2026-70639 (6.8). All four are b1886 through b7445, and GHSA lists b7446 and later as unaffected. Read that boundary as a range end rather than a shipped security fix: the researchers state the maintainer closed every report without a fix or a CVE assignment. If you build against the Android bindings, b7446 is still the number to clear.

The timeline is the part to sit with. First report July 2025, MITRE contacted in October 2025 for assignment, more advisories through the first half of this year, identifiers finally allocated by VulnCheck in May 2026, a public patch pull request in June that was closed unmerged, and GHSA publication last week. Thirteen months from first report to a public record, and the record's fixed-version field is empty.

None of which is a maintainer failure, exactly, and this is where the project's position matters. llama.cpp's security policy says plainly that if a model has to be exposed to an untrusted network you should not be using llama-server, the RPC backend or ggml-rpc-server — sandboxing, input validation and transport encryption are the operator's job, not the library's. Read against that policy, six of these advisories describe conditions the project already told you it does not defend against. This is the second time in nine days the same argument has surfaced: the CVE-2026-17500 discussion on August 3 stalled on the same point, with the collaborator granting the fix looked correct and disputing the severity on deployment grounds.

So the defensive action is not a version bump. It is confirming that llama-server is bound to localhost or behind an authenticating proxy, that nothing untrusted can write to your slot save directory, and that --sleep-idle-seconds is off unless you need it. If those three hold, most of this batch has no reachable path. If any of them does not hold, you have no patch to reach for, and that is the whole finding.

Milvus — an unauthenticated shutdown, and the fix is parked. CVE-2026-69111 (8.7, CVSS 4.0) is a management endpoint on port 9091 with no authentication in front of it: one unauthenticated HTTP GET stops the proxy, datanode or querynode. Availability only — no data read, no write, no code execution — but the score is high because the bar is nothing at all. Affected is everything through 2.6.22 and 3.0.0, which is to say every current release.

The repository history explains the empty fix column. Issue #50763 was opened June 24, triaged, accepted and closed against the 3.0 milestone — while the advisory lists 3.0.0 as affected. PR #49847, which adds optional authentication to the management-plane endpoints on 9091, was approved on July 6 and passed CI on July 27. It is still open. 2.6.22 shipped on August 4 without it.

Port 9091 has now produced two advisories in six months. The February critical, CVE-2026-26190, was unauthenticated access to the REST API on the same port, and the mitigation then is the mitigation now: 9091 is a metrics and management port, it does not belong on any interface a user can reach, and if your Milvus is in Docker on a host with other services, check what your compose file publishes rather than what you meant it to publish. That is the fix available to you today, and it works on both.

Standing items. The reviewed npm and pip feeds have not moved since Thursday — nothing has published to either in four days, which is a curation gap rather than a quiet week, so anything filed over the weekend is queued rather than absent. The llama.cpp JSON-schema-to-grammar denial-of-service pair (CVE-2026-17500, CVE-2026-17501) is unpatched for a fifteenth day, PR #25308 still open and untouched since August 3. n8n's seventeen August 5 advisories have not reached the global npm advisory database on day six — the newest n8n entry there is still July 22 — so check 1.123.69 / 2.33.4 / 2.34.1 by hand. NLTK still wants 3.10.2, and yesterday's low CVE-2026-12372 (3.7) arrived as an unreviewed entry with no fixed version. The MCP CVE wave is in its fourth day, with roughly twenty more filed across Saturday and Sunday — article-scraper-mcp, spec-workflow-mcp, Ollama-mcp, obsidian-mcp-server, api-mcp and the rest of that size class — still no fixed versions, still inventory work rather than patch work. Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, re2 wants 1.26.1, Open WebUI wants 0.11.0 with no 0.10.x backport, Flowise wants 3.1.4.

On the Venicecom side, the August servicing release is today and had not published when this went out — Microsoft's monthly drop lands around 19:00 Rome, so tomorrow's digest covers it. Nothing has published to the NuGet advisory database since July 31, and the newest Angular items remain the August 3 batch this digest covered on the 4th. primeng is still archived, with no repository that can issue a security fix.