The reviewed feed came back yesterday after three days dark, and it arrived carrying two months of backlog. Two items in it need action this morning: vm2 closed five advisories with one patch release, three of them critical and the worst a 9.9, and MLflow has four advisories closed by one release that has been on PyPI since July 31 — a 9.3 unauthenticated SSRF, and an 8.8 that carries no CVE and appears nowhere in the reviewed database. Everything else in the batch is a disclosure from May or June reaching the database late.

Worth your morning

vm2 — five advisories, one release, and it was out before you heard about any of them. 3.11.6 published to npm on August 14 at 20:11 UTC. The five advisories it closes were published the same day and reviewed into GitHub's database on the 17th: a 9.9 (CVE-2026-47686, unsanitised Error.cause), a 9.8 (CVE-2026-47698, host prototype mutators), a 9.3 with no CVE assigned covering what builtin set to a wildcard hands out, and two allocation-limit bypasses at 8.7 and 7.5. The release notes are three lines and say the useful thing: five advisories closed, no API changes for valid configurations.

This is a bigger row than its download graph suggests, because vm2 is rarely something you chose. It is the sandbox underneath JavaScript code-execution nodes in agent frameworks and workflow tools — the same component family behind the NodeVM escape in Flowise's July batch, which is now permanent because that repository is archived. If any part of your stack runs model-authored or user-authored JavaScript in a sandbox, find out whether vm2 is what the sandbox is. Three of these five put the guest on the host, and the first two need no privileges at all.

The upgrade is cheap for a sandbox library — a patch bump with no API break for correct configurations. Take it today.

MLflow — one release closes four, and the records are scattered across three places. CVE-2026-64849 is 9.3, unauthenticated, network-reachable, and lands on a default server through webhook delivery. Affected is everything below 3.15.0. That version went to PyPI on July 31; the advisory published August 2 and was reviewed on the 17th. Current is 3.15.1, out August 3. Alongside it, CVE-2026-69148 (7.1) is a missing READ check on referenced run IDs and CVE-2026-69146 (6.5) is a handler absent from the authorization map — both closed by that release, both authorization gaps rather than parser bugs, which means a multi-tenant tracking server is where they matter and a single-user one mostly isn't.

There is a fourth, and it is the one least likely to have reached you. GHSA-gqvg-gmmx-x4hm is 8.8, a bypass of the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control, affecting everything from 2.1.0 up — a far wider range than the other three — and closed by the same 3.15.0. It has no CVE assigned and lives only on MLflow's own advisory page; it is not in the reviewed database, so no scanner reading the global feed has it. It published July 27, three weeks ago.

Now the part that will not show up in your scanner either. The 9.3 is filed in the pip ecosystem. Two of the others are filed in npm, against a package called mlflow whose latest published version is 2.0.7, from August 2019 — ten versions, seven years untouched, and no path by which 3.15.0 could ever appear there. The fixed version named in those two advisories does not exist in the registry the advisories were filed against. This is the Budibase shape from Saturday, inverted: there the fix was real and the registry was stale; here the ecosystem assignment is stale. If your inventory splits by ecosystem, one scanner sees a critical and the other sees two unfixable highs. It is the same server and one pip install.

9router, third time. CVE-2026-56677 (8.6) hit NVD yesterday against the OIDC provider test endpoint, affected 0.5.4 and earlier, no fixed version named. This digest covered 9router's default JWT secret on July 4 (fixed in 0.4.45) and two unpatched credential-theft criticals on July 9 at 0.4.71 and earlier, including a clean 10.0 — and CVE-2026-55500 still has no patched version, six weeks on.

npm's current 9router is 0.5.55, published August 14, which sits above every affected ceiling anyone has published. That is not the same statement as fixed. No advisory names a fixed release, no release notes claim these, and the project keeps shipping past the ranges rather than closing them. Running current puts you outside the stated ranges by version arithmetic and nothing more. Treat it as network placement, not patching: keep the dashboard off any interface you don't control, and rotate the provider keys it holds if it was ever reachable.

The late arrivals. chrome-devtools-mcp (6.1, CVE-2026-53766) affects 0.24.0 through 1.0.1 and was fixed in 1.1.0 on May 26. npm is on 1.7.0. The advisory reached the reviewed database yesterday — eighty-three days after the fix. The atomic-agents-stack pair (8.7 cleartext catalog fetch, 8.7 cost guardrail returning zero for unpriced models) published June 10 and reviewed yesterday; both close in 1.1.0, the same version that fixed the dashboard read this digest tabled on the 14th, and 2.0.0 is current. Nobody on latest has been exposed to any of these three for months. Anyone pinned got no signal until yesterday.

Standing items. Milvus CVE-2026-69111 (8.7): PR #49847 has an approval now, but Code-Check is failing and taking the test stages down with it, so nothing has merged. Keep port 9091 firewalled. The llama.cpp JSON-schema-to-grammar pair (CVE-2026-17500, CVE-2026-17501) is unpatched on day twenty-two, and PR #26939 has not moved since August 12 — still zero of the two approvals it needs. Keep schema input inside your trust boundary. Yesterday's six MCP CVEs are unchanged: four with no fix, two fixed only as commits on main. Carried unchanged: mcp-grafana closed at 1.1.0, Flowise archived at 3.1.4 with four criticals permanent, mcp-florence2 declined by the vendor, AgenticSeek needs AGENTICSEEK_API_TOKEN set plus a loopback bind, @budibase/server wants 3.41.3 through the deployment rather than npm, @ooples/token-optimizer-mcp wants 5.1.0, mcp-contextforge-gateway wants 1.0.3, Langflow wants 1.11.3, NLTK wants 3.10.3, vLLM wants 0.27.0, Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, re2 wants 1.26.1, Open WebUI wants 0.11.0, n8n wants 1.123.69 / 2.33.4 / 2.34.1, @trigger.dev/core wants 4.5.6, SSH.NET wants the 2026.0.0 major, .NET wants 8.0.30 / 9.0.19 / 10.0.11.

Feed notes. The reviewed npm and pip databases published nothing on the 15th, 16th or 17th and then cleared a queue on the 17th, which is where this entire table comes from. Original disclosure dates in that queue run from May 18 to August 14 — the reviewing, not the disclosing, is what happened yesterday. The MLflow 8.8 is not from that queue at all: it came off MLflow's own advisory page, which is the only place it exists. Filtered out: four sqlparse advisories and five for Glances, all pip, none touching a tracked component; Etherpad, Medplum and DeepmergeTS on the npm side for the same reason. Nothing new on the Venicecom stack — NuGet has published nothing since the SIPSorcery and SSH.NET entries on the 12th, the August 11 .NET batch is unchanged, Angular's August 13 releases still carry no security designation, and primeng remains archived. No new advisories from Ollama, vLLM, LangChain, LlamaIndex, llama.cpp, Open WebUI, Milvus, Qdrant, Chroma or the MCP reference servers in the last forty-eight hours.