MCP servers are the morning — six of them, and the thread running through all six is not severity. It is that none of these advisories can be expressed as a version bump. Four of the projects have never published a release or a tag, so the two fixes that do exist are commits on main, and the four without a fix have nothing to pin either way. All six landed as unreviewed entries with no package mapping, which is why your scanner has said nothing about any of it.

Worth your morning

Three unanswered reports, all filed the same week in June. CVE-2026-19957 (SSRF, CWE-918) in graphlit-mcp-server, CVE-2026-19958 (code injection, CWE-74) in pptr-mcp, and CVE-2026-19964 (injection, CWE-74) in Jij-Inc's MCP server were all reported to their projects as public GitHub issues on June 29. All three issues are still open with zero maintainer comments, forty-nine days later. There is no fix, no branch, and nothing to suggest one is coming. Public exploit code exists for each — the advisories say so — which is the part that makes the silence operationally relevant rather than merely rude.

The affected-version fields are worse than empty. pptr-mcp is affected through 0.2.7, and 0.2.7 is the newest version npm has, published in January — the latest release is the vulnerable one, so there is no upgrade, only a decision about whether to keep running it. And the advisory for graphlit-mcp-server names version 1.0.1; the package has published 241 versions and none of them is 1.0.1. It uses date-stamped versions in the shape 1.0.20260112001, its repository carries no tags and no releases at all, and the newest thing on npm is from January 12. The version string in the advisory does not identify anything that exists.

For all three the control is placement, not patching: keep them off any network path that reaches something you care about, give the SSRF pair no route to internal addresses or cloud metadata, and treat the two injection cases as code execution in whatever account the server runs under. If one of these is wired into an agent that handles untrusted input, that is today's item.

mcp-florence2 — the vendor answered, and the answer is no. CVE-2026-19984 (6.3, CWE-918) affects everything through 0.3.13, and the maintainer's position is quoted in the advisory itself: deployments that need SSRF protection should route all HTTP(S) requests through an SSRF-safe proxy, which mitigates the issue without changing the source. That is a coherent position for a tool assumed to run against trusted inputs, and it is worth reading as what it is — the fixed version is not late, it is not planned. Third project this digest has tracked into that state, after primeng and Flowise, and the only one to get there by choice rather than by shutting down.

The practical difference matters. A declined CVE never leaves your inventory: no future version bump clears it, so it has to be closed with a compensating control and a note saying why, or it will be re-flagged every quarter forever. If you are running it, the control is an egress proxy or network policy that denies internal ranges, applied to the process — not to the package.

Two fixes, and both of them are commits. CVE-2026-19956 (SSRF) in gomarble's facebook-ads-mcp-server was fixed by PR #32, merged July 20 — twenty-seven days before the CVE published. CVE-2026-19978 (command injection, CWE-77, and local-only at AV:L) in android-mcp-server was fixed on July 11 by the commit that is currently the head of its default branch; the affected commit before it dates from May 2025, so the repository's entire recent history is the vulnerable state followed by the fix. Neither project has ever cut a release or a tag. VulDB's entry for the second one states the problem in plain terms — the project ships a rolling release, so version information for affected and updated builds does not exist.

If you deployed either by cloning, you are fixed by pulling and you have been for weeks without knowing. If you vendored a copy in June, you are not, and no version comparison anywhere will tell you which of those you are. Check the commit you have.

One note on the numbers in that table. Five of these six carry a low severity label in the GitHub database while scoring 6.3, 6.3, 6.3, 5.5 and 5.3 under CVSS 3.1. The label is not wrong — GitHub derives it from CVSS 4.0, and the 4.0 scores here are 2.1, 2.1, 2.1, 2.0 and 1.9. Two scales, same defects, a four-point spread. If your triage filters on the severity label rather than the score, this entire morning is invisible at any threshold above low, which is roughly where most filters sit.

Standing items. The llama.cpp JSON-schema-to-grammar pair (CVE-2026-17500, CVE-2026-17501) is unpatched on day twenty-one, and PR #26939 has not been touched since August 12 — two commits, no approvals, and it needs two. Keep schema input inside your trust boundary. Milvus CVE-2026-69111 (8.7) is unchanged from Friday: PR #49847 is still open with failing checks after the ten-commit push, so keep port 9091 firewalled. mcp-grafana stays closed at 1.1.0 — yesterday's correction holds, and if you route one MCP server at several Grafana instances the upgrade needs a config change. Carried unchanged: Flowise is archived at 3.1.4 with four criticals permanent, AgenticSeek needs AGENTICSEEK_API_TOKEN set plus a loopback bind, @budibase/server wants 3.41.3 through the deployment rather than npm, @ooples/token-optimizer-mcp wants 5.1.0, mcp-contextforge-gateway wants 1.0.3, Langflow wants 1.11.3, NLTK wants 3.10.3, vLLM wants 0.27.0, Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, re2 wants 1.26.1, Open WebUI wants 0.11.0, n8n wants 1.123.69 / 2.33.4 / 2.34.1, @trigger.dev/core wants 4.5.6, SSH.NET wants the 2026.0.0 major, .NET wants 8.0.30 / 9.0.19 / 10.0.11.

Feed notes. GitHub's reviewed npm, pip and NuGet databases published nothing at all on August 16 or 17 — the six items above come from the unreviewed global feed, which is why none of them has a package field, an affected range a lockfile could match, or a Dependabot alert behind it. That is the third weekend running with the reviewed feeds dark and the unreviewed one carrying the AI-stack material. The tracked upstream repositories are quiet: no new advisories from Ollama, vLLM, LangChain, LlamaIndex, llama.cpp, Open WebUI, Milvus, Qdrant, Chroma or the MCP reference servers in the last forty-eight hours. Nothing on the Venicecom side either — Angular's August 13 releases still carry no security designation, NuGet has published nothing since the 12th, and primeng remains archived. The only high and critical entries in the global feed this morning are consumer routers and a desktop application, none of it tracked here.