mcp-grafana is the morning, and it is a correction. The 9.1 SSRF this digest has carried since Wednesday as a critical with no fixed version has had one since August 10 — Grafana's own security advisory names 1.1.0, and the GitHub record that Dependabot reads still shows an empty fix column. Behind it, Flowise was archived on the 13th with four criticals from July still standing, and Budibase patched a high in a version that never reached the registry the advisory was filed against.

Worth your morning

mcp-grafana — the fix has existed since before the CVE published, and this digest read it wrong. CVE-2026-19516 is fixed in Grafana MCP 1.1.0. Grafana's own advisory states it plainly: affected versions are everything below 1.1.0, and the mitigation is to upgrade. This digest has carried it since Wednesday as a critical with no patch, on the basis of the GHSA entry — which is unreviewed, lists no package, no affected range and no fixed version, and is what a scanner sees.

The mechanism is in the v1.1.0 release notes under Removed, which is the section nobody reads. PR #1052, merged August 10, drops support for the undocumented X-Grafana-URL header outright. The header the CVE describes does not exist in 1.1.0. This digest looked at the same release on Wednesday, found the bearer-token authentication in the Added section, and reported that as a reachability control rather than a fix — the fix was four sections further down. The July patch that bound credentials to the configured URL was the partial one; this is the complete one.

Two things worth keeping. The release landed August 10 and the CVE published August 11, so there was never a day where the fix did not exist — the public record simply never caught up with it. And the removal is a breaking change for anyone who used the header to route one MCP server at several Grafana instances, which the PR thread raised and the maintainers overrode. If that is your topology, the upgrade needs a config change, not just a version bump. Standing item closed: go to 1.1.0, keep caller authentication on anyway.

Flowise — archived on the 13th, and the last release is the last release. The announcement posted August 13: the maintainers are winding the project down. Pull requests stopped being accepted on July 29, the repository went read-only on August 13, and core-team support ends August 31. The code stays under Apache 2.0 and the stated path forward is to fork it.

What that means for this digest is specific. 3.1.4 shipped July 29 — the same day PRs closed — and has been the standing recommendation here for two and a half weeks. It is now permanent. The four criticals published July 29 (NodeVM sandbox escape, two CSV-agent RCEs, and a pandas sandbox bypass) were the last batch anyone will triage, and there is no repository left that can issue a fix for the next one. Nothing about your running instance changed this weekend; what changed is that patching stopped being an option. If Flowise is in a production path, this is a migration on a clock, and the clock started thirteen days ago. Second project on this digest's watch list to reach that state after primeng.

Budibase — a fixed version that exists everywhere except the registry the advisory was filed against. CVE-2026-35219 (7.1, CWE-918) is server-side request forgery in the automation steps — webhook, Zapier, n8n, Slack, Discord, Make.com — where user-supplied URLs are requested without the IP blacklist applying, and the REST integration ships with that blacklist empty by default. It needs low privileges and no user interaction, and it published August 14 against @budibase/server in the npm database.

The fixed version is 3.41.3, released August 4. It is not on npm. The registry's newest @budibase/server is 3.38.1, published May 12, and 3.41.3 does not appear anywhere in the package's 3,142 published versions. Budibase ships through Docker and its own release channel; the npm package trails it by three months. So the advisory is technically complete — affected range, fixed version, both stated — and following it through the package manager it names gets you nothing. Update the deployment. If your inventory tracks Budibase by its npm version, that number has been frozen since May and is not telling you what you are running.

Two MCP servers, both patched, both surfacing late. CVE-2026-55157 (8.4) is OS command injection in @ooples/token-optimizer-mcp and CVE-2026-55156 (5.3) is unauthenticated path traversal in its dashboard endpoints — a local vector on the first, network on the second, both fixed in 5.1.0 and the package is on 5.7.0 as of August 11. CVE-2026-53708 (6.6) in IBM's MCP Context Forge gateway is a DNS time-of-check-time-of-use gap in the SSRF guard on /admin/gateways/test: the validator resolves a hostname and then hands the client the hostname rather than the address it validated, so the client resolves it again on its own. Fixed in 1.0.3, current is 1.0.7. The advisory notes the maintainers had the limitation tracked in code comments and a ticket before it was reported.

Both reached the global database on August 14 and both were published by their repositories in June — sixty-five days for the ooples pair, sixty for ContextForge. That is the same lag the NLTK and stata-mcp entries showed last week, running the same direction: anyone tracking current is already patched and gets the alert two months later, anyone pinned had two months of silence.

Standing items. Milvus CVE-2026-69111 (8.7) moved for the first time since July 27 — PR #49847 took ten commits on August 14, clearing the rebase and adding credential redaction, immutable security parameters and root auth on the management-plane metrics. Still open, still assigned to a reviewer, but it is alive. Keep port 9091 firewalled and check back this week. The llama.cpp JSON-schema-to-grammar pair (CVE-2026-17500, CVE-2026-17501) is unpatched on day twenty, and PR #26939 has not moved since the automated review flagged it on August 12; it needs two approvals and has none. Keep schema input inside your trust boundary. Carried unchanged: AgenticSeek still has no releases to pin and needs AGENTICSEEK_API_TOKEN set plus a loopback bind, Langflow wants 1.11.3, NLTK wants 3.10.3, Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, re2 wants 1.26.1, Open WebUI wants 0.11.0, n8n wants 1.123.69 / 2.33.4 / 2.34.1, @trigger.dev/core wants 4.5.6, SSH.NET wants the 2026.0.0 major, .NET wants 8.0.30 / 9.0.19 / 10.0.11.

Feed notes. This covers two days — Friday's digest went out before the 14th's advisories landed, and there was no digest on the 15th. Nothing in the reviewed npm, pip or NuGet feeds published on August 15 or 16; everything in today's table is Friday catch-up. The global feed for both days is almost entirely WordPress plugin entries, which is the normal weekend shape. On the Venicecom side there is nothing: Angular's August 13 releases (20.3.28, 21.2.20, 22.1.2) still carry no security designation, NuGet has published nothing since the SSH.NET and SIPSorcery entries on the 12th, and primeng remains archived. The MCP advisory wave that ran twenty a day through early August has stayed stopped — the two entries above are June disclosures arriving late, not new filings.