Four days of backlog, and the severity is real: Xinference carries a 10.0 that has been fixed since April and was only disclosed on Thursday, jsonata closed three code-execution criticals, and MONAI has three closed by one release — one of them a re-disclosure of a flaw a previous advisory said was already patched. Two items are worth more than their scores. Node-RED's current release moved its jsonata pin forward and then rolled it back, and the LangChain MongoDB advisory names a fixed version for each of its two packages, both of them wrong.

Worth your morning

Xinference — a 10.0, and the fix is four months old. CVE-2026-61539 scores AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, no privileges, no interaction, and it changes scope. Those are all the worst values at once, which is what a 10.0 is. It sits in the Llama3 tool-call parsing path, so it is reachable on a server doing the ordinary thing an inference server does.

Affected is everything up to and including 2.5.0. That version went to PyPI on April 12; 2.7.0 closed it on April 25, thirteen days later. There is no 2.6.x — the range is contiguous and the arithmetic is simple. The advisory published on August 21, one hundred and eighteen days after the fix shipped.

Current is 3.2.1. If you track releases you have been fine since spring and heard nothing about it until Thursday. If you pinned 2.5.0 in April you have been sitting on an unauthenticated, scope-changing 10.0 for four months with no alert behind it, because the advisory that would have raised one did not exist. Check the pin, not the changelog.

jsonata — three criticals, and Node-RED's current release reverted the fix. Three advisories published August 21, all arbitrary code execution, all 9.3 under CVSS 4.0: CVE-2026-77413, CVE-2026-77414, CVE-2026-77415. The 1.x line needs 1.8.8, the 2.x line needs 2.2.1. Both shipped months ago — 2.2.1 on May 19, 1.8.8 on July 16 — and npm currently offers 2.2.2 and 1.8.9. This is a library that pulls 1.65 million downloads a week and is almost never something you installed on purpose; it is the expression evaluator inside flow-automation tooling.

Which is where it gets awkward. @node-red/util published three releases on July 30. 5.0.2 pinned jsonata 2.2.2. 5.0.3 pinned 2.2.1. 5.0.4 pinned 2.0.6 — back below the floor, and 5.0.4 is the current release. The pin is exact, with no range specifier, so npm update will not move it and no caret will save you.

Read the dates before reading intent: all of that happened on July 30, and the advisories published on August 21. Nobody reverted away from a known-vulnerable version, because for three more weeks nothing said it was one. The effect is the same either way. If you run Node-RED, the jsonata under it is 2.0.6 and all three advisories cover it, and getting off that pin means overriding it yourself rather than waiting for an upgrade to do it.

LangChain MongoDB — one CVE, two packages, both fixed versions wrong. CVE-2026-55253 (7.7, NoSQL operator injection, cross-tenant exposure) covers langgraph-checkpoint-mongodb and langgraph-store-mongodb. The advisory says checkpoint is fixed in 0.3.0 and store is fixed in 0.4.0. Its own linked release tags say the opposite: libs/langgraph-checkpoint-mongodb/v0.4.0 and libs/langgraph-store-mongodb/v0.3.0, both published May 12. PyPI agrees with the tags: store-mongodb's newest version is 0.3.0 and 0.4.0 does not exist, while checkpoint-mongodb's 0.3.0 dates from November 2025, six months before the fix landed.

The two errors fail in opposite directions, and only one of them is loud. Store users get told to install a version that was never published, which is annoying and self-announcing — the upgrade fails, someone investigates. Checkpoint users get told that 0.3.0 patches them. It does not. It predates the fix by half a year, it is a version plenty of people are actually running, and a scanner reading this advisory will mark them clean and move on. That is the direction that costs you something, because nothing about it looks like an error.

Take 0.4.0 for checkpoint and 0.3.0 for store. Both are current, both are the tagged fix, and if a scanner argues about store-mongodb, the scanner is wrong.

MONAI — three at once, and one of them is a repeat. All three close in 1.6.0, out June 22: OS command injection at 8.6, unsafe deserialization in NumpyReader at 7.8, and GHSA-qxq5-qhx6-94qw, also 7.8, whose title is the whole story: the algo_from_pickle() RCE is still present in 1.5.2 despite the earlier GHSA-89gg-p5r5-q6r4 claiming a patch. If you read that first advisory and upgraded to 1.5.2 believing it closed, it did not, and 1.6.0 is the version that does. The two deserialization items are AV:L/UI:R — they need a file you were going to load anyway, which in a medical-imaging pipeline is not a high bar.

Standing items

llama.cpp is fixed. PR #26939 merged on August 20 at 11:59 UTC with the two approvals it had been waiting on since August 12. That closes CVE-2026-17500 and CVE-2026-17501, the JSON-schema-to-grammar pair this digest has carried unpatched since late July — twenty-four days from disclosure to merge. Every build tagged since carries it, b10549 on the 21st onward, and the tree is up to b10582 as of this morning. If you build from source, pull. The trust-boundary advice on schema input can come off the board.

Milvus has not moved. CVE-2026-69111 (8.7) is unchanged: PR #49847 is still open, still has zero approving reviews behind ten comment-only ones, and has not been touched since August 14 with a dirty merge state. Keep port 9091 firewalled.

Carried unchanged: vm2 wants 3.11.6, MLflow wants 3.15.0 or later including the 8.8 that carries no CVE, 9router remains unpatched across three advisories with no fixed version ever named, Flowise is archived at 3.1.4 with four criticals permanent, mcp-florence2 is declined by the vendor, the four MCP servers from the 17th still have no fix and two more are commit-only, mcp-grafana closed at 1.1.0, AgenticSeek needs AGENTICSEEK_API_TOKEN set plus a loopback bind, @budibase/server wants 3.41.3 through the deployment rather than npm, @ooples/token-optimizer-mcp wants 5.1.0, mcp-contextforge-gateway wants 1.0.3, Langflow wants 1.11.3, NLTK wants 3.10.3, vLLM wants 0.27.0, Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, re2 wants 1.26.1, Open WebUI wants 0.11.0, n8n wants 1.123.69 / 2.33.4 / 2.34.1, @trigger.dev/core wants 4.5.6, SSH.NET wants the 2026.0.0 major, .NET wants 8.0.30 / 9.0.19 / 10.0.11.

Feed notes. This covers four days rather than the usual one — the reviewed npm and pip databases ran heavy from the 18th through the 21st, and every item above comes from them. Original disclosure dates across the batch run from April to August; the reviewing is what happened this week. Nothing on the Venicecom side at all: NuGet has published no reviewed advisory since the SIPSorcery pair and SSH.NET on August 12, Angular's August 19 releases (22.1.3, 21.2.21, 20.3.29) carry no security designation, the August 11 .NET batch is unchanged, and primeng remains archived. The tracked upstream repositories are quiet — no new advisories from Ollama, vLLM, LangChain core, LlamaIndex, llama.cpp, Open WebUI, Milvus, Qdrant, Chroma, Weaviate, Haystack, Triton, transformers or the MCP reference servers since the 18th. Filtered out: eleven Wagtail and django-CMS advisories, eight for Lemur, four for MobSF, and the Tina, NocoBase, Unleash, MagicMirror and node-opcua groups — all real, none touching a tracked component. The unreviewed global feed was a hundred entries of WordPress plugins, TRENDnet and TP-Link routers, Esri ArcGIS and Joomla extensions, with nothing in the AI stack in any of it.