AgenticSeek is the morning. An unauthenticated remote code execution at 9.8 against an autonomous-agent project with 26,000 stars, no releases, no tags and no version numbers — so there is nothing to pin to and nothing for a scanner to compare against. A fix merged three days before the CVE published, and it takes effect only if you set an environment variable. Behind it, Langflow takes a 9.1 whose only cited bulletin returns a 403, and Trigger.dev's prototype pollution reaches out of the tenant it started in.

Worth your morning

AgenticSeek — a 9.8 against a project that has no version numbers. CVE-2026-72776 is CVSS 3.1 9.8 and CVSS 4.0 9.3, CWE-306, missing authentication for a critical function. The /query API endpoint is served without authentication, the default bind is 0.0.0.0:7777, and CORS is wildcard — so anything that can reach the port can drive the agent, and the impact is code execution on the host running it. High across confidentiality, integrity and availability, no privileges and no user interaction. Published August 14 at 00:32 UTC against commit fc242c7.

The fix exists and its shape is the finding. PR #534 merged on August 11 at 14:14 UTC — three days before the CVE reached the database — and the title carries the whole thing: require a bearer token on /query when AGENTICSEEK_API_TOKEN is set. Set the variable and the endpoint is authenticated. Leave it unset and the endpoint is exactly what the CVE describes. A remediation that is off by default is a configuration option with a security changelog entry.

The other half is that there is nothing to upgrade to. The repository has published no releases and no tags in its entire history, so there is no version string for a lockfile, no fixed-version field for an advisory to carry, and no comparison a dependency scanner can make. Pulling main is the only upgrade path available, and pulling main on its own does not close this. Defensive action in order: set the token variable, bind the service to loopback instead of all interfaces, and put authentication in front of it if it has to be reachable at all. The last commit to the repository is that merge, three days ago.

Langflow — a 9.1, and the bulletin behind it is a 403. CVE-2026-19297 is improper restriction of excessive authentication attempts (CWE-307) in IBM Langflow OSS 1.0.0 through 1.9.6, scored 9.1 by IBM's own PSIRT: network vector, no privileges, no user interaction, high confidentiality and integrity. What it yields is access to other people's accounts on your instance.

The record around it is thin enough to be worth naming. NVD published on August 13 in Received status — no CPE configuration, no fixed version, and exactly one reference, an IBM support page that returns HTTP 403 to an unauthenticated request. The authoritative statement of what fixes this is not publicly readable this morning. What is readable: the affected range stops at 1.9.6, and 1.11.3 shipped to PyPI and GitHub on August 11. Go to 1.11.3. If you are pinned somewhere in 1.9.x, the specific version that closes this is behind a page you cannot open, which is its own argument for taking the current release rather than trying to find the minimum one.

Trigger.dev — prototype pollution that leaves the tenant. CVE-2026-73654 (8.5, CWE-1321) is in the run-metadata update endpoint: client-supplied operation keys are applied to the metadata object with no prototype-pollution guard, and the path library underneath does not reject the dangerous key names. A caller holding an ordinary low-privilege environment API key can therefore corrupt object state for the whole process.

The consequences the advisory names are the ones to plan around: query-building failures, broken authentication for other tenants' workers, and an uncaught exception that ends the process. Note S:C in the vector — CVSS stating that the blast radius leaves the security scope the API key was issued inside. Affected @trigger.dev/core from 3.3.8 through 4.5.5, fixed in 4.5.6, and 4.5.11 is current. If you run self-hosted Trigger.dev as the job runner behind an AI product with more than one customer on it, this is the row that describes your setup.

Three quieter ones, and all three are already behind you if you track current. CVE-2026-73298 against Microsoft's Container Migration Solution Accelerator — the multi-agent tool for moving container configurations onto AKS — is an authenticated IDOR across process and file management APIs: ownership checks are missing, so users read, modify and delete other users' migration data inside the same organisation. The repository advisory published July 23 rating it medium with an affected range of < 2.1.2. NVD published it August 12 at 8.7, with a description saying "version 2.1.2 and earlier". Two bands of severity and a disagreement about whether the current release is the fix or is affected; v2.1.2 is the newest release the project has cut, from June 25, so take it either way.

GHSA-rm43-82j9-r4mj (8.2) is arbitrary file read in the optional dashboard server of atomic-agents-stack, all versions through 1.0.0, fixed in 1.1.0 and 2.0.0 is current. The advisory is unusually honest about reachability: the default bind is loopback, but --host is a documented operator flag, and loopback alone is not a boundary against DNS rebinding from a browser or a request originating from a co-located service. CVE-2026-54249 (6.8) in Pydantic AI is the one worth understanding structurally: UI adapters rebuild file parts from client-submitted message history, URL parts get checked against a scheme allowlist, and UploadedFile references — provider file IDs and s3:// or gs:// URIs — did not. The provider then resolves them using your IAM role or API key. Fixed in 1.106.0 and 2.0.0b6; the 2.x line is at 2.30.0 now.

NLTK — a seventh advisory, and the feed direction reversed. CVE-2026-12243 (7.5, CWE-22) is arbitrary file read in nltk.data.load() and nltk.data.find(): path-safety checks run against the raw resource name, and the decoding step that resolves percent-encoded sequences happens afterwards, so validation inspects one string and the filesystem receives another. Everything below 3.10.0 is affected and 3.10.0 fixes it.

Yesterday this digest covered six NLTK advisories that existed only in the repository, invisible to the global feed — the newest global entry was July 31. This one is the mirror image: it published to the global reviewed pip database on August 13 and does not appear in the repository's advisory list at all. Same package, same week, two disjoint sets of records, neither of which is complete. The practical answer does not move: 3.10.3, which this digest called yesterday, covers this one comfortably.

Standing items. The llama.cpp JSON-schema-to-grammar pair (CVE-2026-17500, CVE-2026-17501) is unpatched on day eighteen; PR #26939 has not moved since August 12 and the contributor has not answered the review flags. Keep schema input inside your trust boundary. Milvus CVE-2026-69111 (8.7) got worse rather than better: PR #49847 now reports merge conflicts against master. The PR itself has not been touched since July 27 — master moved out from under it — so an approved, fully green fix is now also a rebase nobody has picked up. Firewall port 9091 and stop expecting this one. mcp-grafana is unchanged: no repository advisory, no fixed version, still v1.1.0 from August 10, so 1.1.0 plus caller authentication remains the control. Carried: Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, re2 wants 1.26.1, Open WebUI wants 0.11.0 with no 0.10.x backport, Flowise wants 3.1.4, n8n wants 1.123.69 / 2.33.4 / 2.34.1, SSH.NET wants the 2026.0.0 major, .NET wants 8.0.30 / 9.0.19 / 10.0.11.

Feed notes. GitHub's reviewed npm feed published again on August 13 after six days dark, so the backlog flagged yesterday is clearing rather than growing. The reviewed pip feed carried a vLLM entry on August 13 — unbounded engine requests from list-shaped completion prompts, < 0.26.0 — which is GHSA-87x5-vmc3-756j, a repository advisory from July 27 that this digest covered on July 28. Seventeen days repo to global, and no table row for it here for that reason. On the Venicecom side it is quiet: Angular cut 20.3.28, 21.2.20 and 22.1.2 on August 13 with no security designation on any of them, NuGet has published nothing since the SIPSorcery pair on the 12th, and primeng remains archived with no repository that can issue a fix.