Ten days of backlog, and almost none of it is new. Between August 25 and 31 the reviewed database emptied a queue of disclosures from June 13 to 15 — twenty advisories against PraisonAI alone, four criticals across MCP servers, and a trojanized PyPI package that shipped a credential stealer. All of it was fixed before July. Two items genuinely landed this week: vLLM discovered that its trust_remote_code=False was decorative on one model path, and Chainlit has a 9.8 unauthenticated RCE that most deployments avoid on a default setting rather than on a version number.

Worth your morning

PraisonAI — twenty advisories, one release, and the release is eleven weeks old. Every one of the twenty published on August 25 names the same fixed version: 4.6.58, out June 13. Current is 4.7.4. The upgrade is one command and it closes the entire set.

The cluster is worth reading as a shape rather than twenty separate items, because thirteen of the twenty are the same class of defect: a control that is present in the configuration surface and absent from the request path. Four separate advisories say the API-key flag is not enforced on serve. The advisory for CVE-2026-55541 (8.8) puts it plainly — the flag is parsed but never wired into the app, so a server started with --api-key supersecret runs wide open. Alongside those sit an auth fail-open in the Recipe server when no secret is set, an unauthenticated Jobs API, an auth_token the AgentServer ignores, and two SSRF checks that fail open on DNS resolution.

The critical is a repeat. CVE-2026-55536 (9.1) is an origin-validation bypass in the browser server's WebSocket handler, and the advisory identifies it as a patch bypass of the earlier CVE-2026-40289 — the regex anchors at the start of the string and not the end, so the previous fix narrowed the hole without closing it. PraisonAI had a smaller advisory batch reviewed on June 18 and 19. This is the second sweep of the same project, and the recurring finding is that the first round's fixes were partial.

If you run PraisonAI exposed to anything, the version bump is the whole remediation, but do not skip the audit that follows it: if you believed an API key was protecting an endpoint, it was not, and whatever that endpoint reached should be treated as having been reachable without one.

vLLM — trust_remote_code=False was advisory on one path. GHSA-3c86-2m5g-59q7 (7.8, no CVE) affects everything below 0.28.0. The LlavaOnevision2 processor loader forwards trust_remote_code to transformers.get_class_from_dynamic_module() — a function that has no such parameter, and therefore treats the flag the way any function treats an argument it does not accept. A crafted model's processor module executes at load time regardless of what the operator set.

The vector is AV:L/UI:R: someone has to load the model. In a shop that pulls checkpoints from a hub, that is the ordinary Tuesday action the flag exists to make safe. vLLM already had the correct pattern in its own wrapper and in the MiniCPM-V loader; this path did not call it.

0.28.0 also carries the four other advisories from the 23rd and 28th — an unauthenticated audio decompression DoS on /v1/chat/completions (CVE-2026-57173, 6.5, fixed in 0.24.0), a video/audio extraction bomb, a sample-rate header that bypasses the decode duration limit, and a GPU decode path that escapes the static VRAM reservation. The standing advice in this digest has been 0.27.0 since July. It is 0.28.0 now.

Chainlit — a 9.8, and the thing that saves you is a default. CVE-2026-45018 is unauthenticated remote code execution on the /mcp endpoint, AV:N/AC:L/PR:N/UI:N, affecting 2.4.0rc0 through 2.11.1 and fixed in 2.12.0. Its sibling CVE-2026-45019 (7.2) is SSRF through the same feature, reaching internal services and cloud metadata with attacker-controlled headers.

Both require features.mcp.enabled = true in .chainlit/config.toml, and MCP has been off by default since 2.7.0. That splits your exposure by configuration rather than by version, which is the part to get right before you triage. On 2.7.0 through 2.11.1 with a default config, you are not affected. On 2.7.0 through 2.11.1 having turned MCP on deliberately — which is to say, having wired Chainlit to tools — you are. On anything from 2.4.0 to 2.6.x you predate the default flip, so the feature was on unless you switched it off.

2.12.0 is the fix and also the current release, so there is no version-arithmetic puzzle here. Take it. If you cannot today, the config toggle is a real mitigation for both CVEs, and the SSRF advisory adds egress restrictions on internal ranges as a second layer.

pantheon-agents — the stealer shipped in June, the advisory shipped last week. GHSA-93qj-5q5v-3c2h has no CVE and is not a code defect. The maintainer's PyPI token was stolen and the attacker uploaded two wheels, 0.6.1 and 0.6.2, carrying a credential stealer that runs at Python startup. It harvests environment variables, ~/.pypirc, ~/.npmrc, ~/.aws, SSH keys and API tokens. Only PyPI was affected — 0.6.0 and earlier are clean, as are GitHub source installs. 0.6.4 is the clean release.

The compromise is dated June 2026 and the advisory published June 15. It was reviewed into the database on August 26, seventy-two days later. For a defect, that lag costs you patch latency. For a credential stealer, it costs you the window in which rotation would have mattered — anything that machine held was exfiltrated in June, and the alert that would have told you arrived last Wednesday. Uninstalling is not remediation here. Rotating every credential that existed on the host is, and the advisory lists the on-disk indicators to check first.

MCP servers, four more, all fixed since June. qwed-mcp is the worst of them at 9.8 — untrusted input reaching SymPy's parse_expr(), which evaluates rather than parses, so a math-verification tool became command execution at process privilege. Fixed in 0.2.1. nextcloud-mcp-server (9.1) is the fail-open pattern again: the webhook authentication check sits behind if secret, WEBHOOK_SECRET defaults to unset, and nothing at startup requires it, so a default install lets any host that can reach port 8000 delete the Qdrant embeddings for any user. 0.117.2 enforces the secret at startup — set it, because upgrading without setting it leaves you where you started. browse-mcp (8.6) wrote to unconstrained paths from three tool arguments and is fixed in 0.8.2. @arikusi/deepseek-mcp-server (8.6) accepted caller-supplied session IDs without binding them to a principal, so one caller could read and continue another's conversation; 1.7.0 gives each transport session its own store, and the affected versions are deprecated on npm.

Two for the delivery stack. The npm MariaDB connector (CVE-2026-55215, 7.5) validates the server's certificate fingerprint after sending credentials, so an active MitM presenting any certificate collects the password before the connection fails. It affects deployments with SSL on but no explicit CA or server certificate configured — which is the common shape of ssl: true and nothing else. Fixes are branch-local: 3.2.4, 3.3.3, 3.4.6, 3.5.3. engine.io (CVE-2026-59724, 7.5) crashes the process on a malformed WebTransport upgrade and is fixed in 6.6.7; WebTransport is not enabled by default, and Socket.IO deployments inherit this through their engine.io dependency, so check the resolved version rather than the direct one.

Standing items

9router now has a fix, for two of eleven. The two advisories reviewed on August 28 — CVE-2026-55641 (8.2, Host-header spoofing on /v1) and CVE-2026-55638 (8.6, /codex authorization bypass) — both name 0.5.2, published July 7. That is a correction worth stating: this digest wrote on August 18 that 9router had no fixed version ever named and that running current was version arithmetic rather than patching. For these two, a named fix had existed for six weeks and the reviewed database had not surfaced it. Current npm is 0.5.59, comfortably above 0.5.2, so anyone on latest is genuinely patched for both. The rest of the eleven, including CVE-2026-55500, still name no fixed release. Keep the dashboard off untrusted interfaces and keep the provider keys rotated.

Milvus, day twenty-one. CVE-2026-69111 (8.7) is unchanged. PR #49847 is still open with one approval, Code-Check still failing after the last force-push, and no activity since August 14. Keep port 9091 firewalled.

llama.cpp stays closed. No new advisories, and the JSON-schema-to-grammar pair remains fixed as of the August 20 merge. Nothing to carry.

@budibase/server picked up another. CVE-2026-54356 (7.1) lets a BASIC-role user in a published app mint S3 signed upload URLs against server-side datasource credentials. Affected is 3.38.1 and below; the references point at 3.41.3, which is the version this digest has been carrying since Saturday week, and which still has to come through the deployment rather than npm. If you took that upgrade you are covered.

Carried unchanged: RestrictedPython now wants 8.3, vm2 wants 3.11.6, MLflow wants 3.15.0 or later including the 8.8 that carries no CVE, xinference wants 2.7.0 or later, jsonata wants 1.8.8 / 2.2.1 with Node-RED's 5.0.4 still pinned to 2.0.6 below the floor, MONAI wants 1.6.0, hydra-core wants 1.3.4, langgraph-checkpoint-mongodb wants 0.4.0 and langgraph-store-mongodb wants 0.3.0 whatever the advisory claims, Flowise is archived at 3.1.4 with four criticals permanent, mcp-florence2 is declined by the vendor, the four unfixed MCP servers from August 17 are unchanged and two more remain commit-only, mcp-grafana closed at 1.1.0, AgenticSeek needs AGENTICSEEK_API_TOKEN set plus a loopback bind, @ooples/token-optimizer-mcp wants 5.1.0, Langflow wants 1.11.3, NLTK wants 3.10.3, Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, re2 wants 1.26.1, Open WebUI wants 0.11.0, n8n wants 1.123.69 / 2.33.4 / 2.34.1, @trigger.dev/core wants 4.5.6, SSH.NET wants the 2026.0.0 major, .NET wants 8.0.30 / 9.0.19 / 10.0.11.

Feed notes. This covers ten days rather than one — the last digest published on August 22. Almost the entire table comes from GitHub's reviewed pip and npm databases clearing a queue between August 25 and 31, and the original disclosure dates cluster hard on June 13 to 15: PraisonAI, qwed-mcp and browse-mcp on the 13th, four MCP servers and utcp on the 14th, pantheon-agents and mcp-contextforge-gateway on the 15th. The CVE identifiers run contiguously through the 2026-555xx range, which is the signature of one audit sweep, reviewed roughly seventy days after the fact. Only Chainlit, aiir and the vLLM batch are genuinely from this week.

On the Venicecom side, Angular shipped 22.1.4, 21.2.22 and 20.3.30 on August 26 and 27 carrying two security-relevant changes — preventing TransferState prototype pollution, and rejecting foreign components in JIT mode — with no CVE, no advisory and no security designation on the release, so nothing will flag it for you. Take it as a normal patch bump. NuGet has published no reviewed advisory since the SIPSorcery pair and SSH.NET on August 12, the August 11 .NET batch is unchanged, and primeng remains archived.

Filtered out and why: aiir (6.9, verification gates reporting success without enforcing, fixed in 1.7.0) is a real fail-open in a supply-chain verification tool but too narrowly deployed to table; eleven Plone, Weblate and senaite advisories; asyncssh twice, including an incomplete fix for CVE-2026-45309; icalendar, webob, aiosmtplib, WsgiDAV, piccolo-admin, eml_parser ×3, starlette-admin, openwisp-ipam, compliance-trestle, djust, Protego, reachy-mini and kas — all real, none touching a tracked component. On npm: suneditor, @logtape/syslog, whistle, mediasoup, @platejs/media, pickem, libreoffice-convert, decode-uri-component and @hono/oauth-providers for the same reason, plus n8n-nodes-sqlite3 (moderate, third-party community node rather than n8n itself). The unreviewed global feed has been WordPress plugins, TOTOLINK and QVidium firmware and a Kimai authorization gap since the 25th, with nothing in the AI stack in any of it. Ollama has published no advisories at all, and nothing new from LangChain, LlamaIndex, Haystack, Triton, Qdrant, Chroma, Weaviate or the MCP reference servers.