NLTK is the morning. Six advisories published on August 11 and 12, none of them naming a fixed version, and one of them a high whose only affected version is 3.10.2 — the release this digest has carried as the standing NLTK recommendation since the start of the month. The fix exists: 3.10.3 shipped on August 12 at 23:44 UTC, hours after the last advisory went up, which is exactly why none of them points at it. Behind that, stata-mcp gives the MCP wave its first entry with a version to install, and SSH.NET patches an arbitrary file write only in a new major.

Worth your morning

NLTK — six advisories, no fixed version on any of them, and the fix shipped the same night. The batch: ReDoS in Text.findall() (high, 7.5, ≤ 3.9.4, the only one naming a patched version at 3.10.0); Corpus Reader Sandbox Bypass (high, CWE-73, affected version 3.10.2, no fix stated); quadratic-time DoS in PorterStemmer and uncontrolled resource consumption in RecursiveDescentParser (CVE-2026-12876, both moderate, ≤ 3.9.2); and two lows against ≤ 3.10.2 — an uncontrolled search path when invoking the Graphviz dot binary and an entity-expansion DoS through remaining raw ElementTree parses.

Five of the six state no patched version, so read from the metadata alone there is nothing to do. Read from the release history there is: 3.10.3 went to PyPI at 23:44 UTC on August 12, after the last advisory published, and its notes line up with the batch weakness for weakness — corpus-reader roots validated against the data sandbox against the CWE-73 bypass, path-traversal and file-I/O sandbox hardening across CWE-22/59/377, and two entries bounding algorithmic-complexity and unbounded-work DoS across CWE-407/400/674/835. That is the fix. It is identifiable by matching release notes to weakness classes, which is not a thing a scanner does.

The part to actually act on: 3.10.2 is now an affected version, and it is what this digest has been recommending. It shipped August 5 to fix a symlink escape in FramenetCorpusReader, held the recommendation for a week, and is now the sole affected version of a high. That is the third time in five weeks the NLTK path sandbox has been patched and then bypassed, and the pattern is stable enough to plan around: go to 3.10.3, and do not treat nltk.pathsec as a boundary you can put untrusted corpus paths behind. Feed it paths you control. The sandbox is a defence in depth that has now failed in public on every release it has shipped in.

One more property, and it is the one that decides whether you hear about this at all. All six are repository-published advisories. The global GitHub Advisory Database's newest NLTK entry is still July 31, so pip-audit, Dependabot and anything mirroring the global feed report a 3.10.2 install clean. This is the third time in twelve days NLTK specifically has been caught this way.

stata-mcp — the MCP wave's first real fix, and it is two months old. CVE-2026-55071 (8.4, high) is a code injection in the ado_package_install tool of MCP-for-Stata: a package name reaches a Stata command string without sanitisation, and the tool is on by default in the standard configuration, so no unusual setup is required to be affected. Vector is local — AV:L/AC:L/PR:N/UI:N, high across confidentiality, integrity and availability — which for an MCP server means the question is who can issue tool calls to it, not who can reach a port.

The dates are the finding. v1.19.0 shipped June 9. The advisory reached the database on August 12, sixty-four days and six releases later; the project is on 1.21.4. So anyone who kept the dependency current is already patched and will get an alert this week telling them about it, and anyone pinned below 1.19.0 has been exposed for two months with nothing to see. The fix was not late. The record was.

Read that against yesterday's mcp-grafana entry — 9.1, published, no fixed version — and the wave has produced both failure modes in two days. One advisory with no patch behind it, one patch with no advisory in front of it. Neither is fixed by buying a better scanner. Across today's digest, three separate components had a real fix that their own advisory metadata does not name.

SSH.NET — a high, and the fix is a major version. CVE-2026-48798 (7.1) is in ScpClient.Download(): file and directory names supplied by the remote SCP server are not adequately validated, so a malicious or compromised server can cause writes outside the intended download directory. CWE-22 and CWE-73, integrity high, and UI:R in the vector — it needs your client to start a recursive download against a server you do not control.

Everything through 2025.1.0 is affected; the fix is 2026.0.0, released August 9, with no 2025.x backport. If you use SSH.NET for SFTP and never call ScpClient.Download() against third-party endpoints, the path is narrow and the major bump can be scheduled. If you pull files over SCP from hosts outside your administrative boundary — vendor drops, partner transfers — that is the case the advisory describes, and the upgrade is a major version with the API changes that implies. Plan it as work, not as a patch.

.NET — the one in Tuesday's batch that needs no local user. This digest covered the August servicing release yesterday and read the two RCE-titled CVEs correctly as local-access items. CVE-2026-62898 (7.5) deserves naming on its own: a use-after-free in Microsoft QUIC, information disclosure over a network, AV:N/AC:L/PR:N/UI:N with high confidentiality impact. No authentication, no user interaction, no local access; Microsoft rates exploitability unproven. It is Windows-only and lands in Microsoft.NETCore.App.Runtime.win-*, which is why it sat outside yesterday's Linux-hosted framing. MsQuic is the HTTP/3 transport, so for a Kestrel estate the question is whether HTTP/3 is enabled — it is not on by default. Fixed versions are the batch's: 8.0.30, 9.0.19, 10.0.11, and self-contained deployments need a rebuild rather than a host runtime update.

vLLM — two moderates, and your tooling cannot see them either. GHSA-cqm8-jxg6-fqfq (5.3) is unauthenticated denial of service through DeepStream backend confusion, AV:N/PR:N/UI:N with low availability impact, against everything below 0.27.0. GHSA-7m6h-x95x-82q5 (5.3) is a cross-user data leak against < 0.21.0, also fixed by 0.27.0. Both published August 11 as repository advisories with no CVE IDs, and the global database's newest vLLM entry is July 20 — same blind spot as the NLTK batch, same morning.

Two critical Azure CVEs with nothing to do, and both are AI services. CVE-2026-62830 is missing authorization in Azure SRE Agent at 9.9 — the highest score in the entire August release, with scope change and an authenticated low-privilege caller. CVE-2026-59118 is improper authorization in Copilot Cowork at 9.3, unauthenticated over a network. Microsoft states both are fully mitigated on its side with no customer action, published under the cloud-service CVE transparency programme. Nothing to install, and worth knowing which agent products have had an authorization failure disclosed against them if you are deciding what to hand them access to.

Standing items. The llama.cpp JSON-schema-to-grammar pair (CVE-2026-17500, CVE-2026-17501) is unpatched on day seventeen. PR #26939 is still open — automated review on August 12 flagged unvalidated negative and reversed quantifier bounds and incomplete handling after the alternation operator, and the contributor has not answered. Two approving reviews are required. Keep schema input inside your trust boundary. Milvus CVE-2026-69111 (8.7) is unchanged for a third week: PR #49847 is approved, green at 8266 of 8266 checks, last touched July 27, still unmerged. Firewall port 9091. mcp-grafana still names no fixed version, so 1.1.0 plus bearer auth remains the control. Carried: Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, re2 wants 1.26.1, Open WebUI wants 0.11.0 with no 0.10.x backport, Flowise wants 3.1.4, n8n wants 1.123.69 / 2.33.4 / 2.34.1.

Two feed notes. The MCP advisory wave stopped — nothing new filed on the 12th or 13th beyond stata-mcp, after five days of roughly twenty a day. And GitHub's reviewed npm feed has published nothing since August 7, six days, newest entry a crypto-js critical; reviewed pip and NuGet both moved yesterday, so this is npm curation rather than a quiet week. Anything filed against an npm package since the 7th is queued, not absent. On the rest of the Venicecom side, Angular's recent releases carry no security designation, primeng is still archived with no repository that can issue a fix, and two SIPSorcery denial-of-service advisories (GHSA-pfvm-w89x-94jw, GHSA-jwjp-4649-v8jp, both 7.5, fixed in 10.0.14) landed on NuGet yesterday — relevant only if you ship WebRTC or SIP.