Two corrections and one new batch. Ollama is not clean and has not been for months — CVE-2026-85180 scores 8.7 and there are three more highs behind it going back to June, which makes "Ollama remains clean" a sentence this digest should stop printing. knowns, an AI project-memory layer that speaks MCP, published eight advisories this morning: seven closed by 0.30.0, one still open on the version you can install today. If you run either, this is a morning for reading rather than skimming.

Worth your morning

Ollama — the standing item was wrong. This digest has closed dozens of mornings with "Ollama remains clean. Still no published advisories, ever." That was true when it was first written and it stopped being true in June. The record: CVE-2026-5757 (high, June 26, information disclosure in model quantization), CVE-2026-15685 (high, July 14, array-index validation), CVE-2026-65315 (high, July 22, unbounded memory allocation in GGUF), and now two more.

The one that matters is CVE-2026-85180, published September 3 at 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) under CWE-918. Ollama does not validate redirect destinations when pulling tensor-layer models, so a pull can be steered to a host you did not choose and reach resources on the network the daemon sits on. No authentication, no user interaction, confidentiality impact high. Affected versions run 0.30.0 through 0.33.2.

Read the fix status carefully, because the advisory does not give you one. No fixed version is listed. 0.33.3 shipped September 2 — one day before disclosure — and is the first release above the affected ceiling, which is the ordinary shape of a quiet coordinated fix. But the release notes say nothing about it, so 0.33.3 is the version to take on inference rather than on the vendor's word. Take it anyway; there is nothing above it but a 0.34.0 pre-release.

The reason this slipped is the reason it will slip again. Both Ollama advisories are repository-level records with no package-ecosystem mapping, so they never appear in the reviewed npm or pip feeds — which is where a dependency scanner looks and where this digest has been looking. A Go binary you installed with a shell script has no manifest for anything to read. Ollama's history is now five highs and a low, and the correct standing line is that Ollama publishes advisories your tooling cannot see.

knowns — eight at once, and the fix has been sitting there since August. knowns is a local-first project-context layer that exposes repository knowledge to coding assistants over CLI and MCP. Eight advisories published this morning. Seven are fixed in 0.30.0, which shipped August 16 — twenty-three days before anyone was told why, so the upgrade has been available for three weeks to anyone who takes minor releases on sight.

The critical is CVE-2026-86543, 9.3 under CVSS 4.0, CWE-306: the management API is served on all interfaces with no authentication and no password on a fresh install, and it can provision publicly reachable tunnels. For a tool whose entire job is holding a readable copy of your codebase, an unauthenticated management plane bound to 0.0.0.0 is the whole security model missing rather than a bug in it.

The six highs cluster into two shapes. Three are path containment failing in different places — CVE-2026-86538 on the templates endpoint, CVE-2026-86541 in the code-replace handler, and CVE-2026-86439 in the filesystem paths the MCP tools accept. Three are unvalidated fields that decide what gets run or loaded: the LSP language binary (CVE-2026-86540), import names in routes (CVE-2026-86542), and an authorization bypass in code mutation (CVE-2026-86544).

This is not the project's first pass through here. CVE-2026-30632 and CVE-2026-30633 (both 7.5) landed on July 21 against the get_doc and update_doc MCP tools in 0.11.4, and neither carries a fixed version to this day. The same tool surface has now produced path-traversal findings in July and September. Anyone on 0.30.0 or later is well past 0.11.4 and does not need to think about the July pair.

The eighth has nowhere to go. CVE-2026-86539 is server-side request forgery through unvalidated outbound requests, reaching internal hosts and cloud metadata endpoints. It affects through 0.33.0, and 0.33.0 shipped September 5 and is the newest release there is. GitHub's advisory list shows a fix in 0.34.0; the advisory body lists no fixed version and NVD marks the code references unfixed. Both readings land in the same place, because 0.34.0 does not exist. Score it as you like — 6.9 on CVSS 4.0, 7.2 and therefore high on 3.1, the dual-scale split this digest keeps tripping over — and put egress rules around the process, because there is no version to install.

So the action on knowns is two-part: 0.30.0 is the floor and 0.33.0 is what you want, and even on 0.33.0 the outbound path is open. If your instance has been reachable from anything untrusted, rotate what the metadata service on that host would hand out.

llama.cpp — the RPC server, again. CVE-2026-86317 (6.9, CWE-617) is a reachable assertion in rpc_server::deserialize_tensor: tensor deserialization parameters arriving over the wire can fail an assertion and take the process down. Availability only, no data impact, and it affects up to 0.4.0 with no patch — the upstream issue was closed automatically due to inactivity, which is now the fix status.

Treat this as a configuration item rather than a patching one. The llama.cpp RPC backend is opt-in, ships as a separate binary, and the project has never held it out as safe to expose. If yours is bound anywhere but loopback, that is the finding, and this CVE is just the paperwork.

Standing items

Milvus, day twenty-eight. CVE-2026-69111 (8.7) is unchanged. PR #49847 is still open with one approval of two, Code-Check still failing, and no activity since August 14 — twenty-five days. Port 9091 stays firewalled.

Carried unchanged from September 7: Open WebUI wants 0.11.1 as the floor with 0.11.3 current, OpenMAIC wants 1.0.1, Bifrost wants transports/v2.0.0 or management auth on, nbviewer is commit-only with no release, rowboat has no fix and wants egress rules, openagents is vendor-declined, codewhale wants 0.8.64 with the cargo deepseek-tui crate still unfixed, vLLM wants 0.28.0, @typespec/spector wants 0.1.0-alpha.27, unstructured wants 0.24.0, NLTK wants 3.10.3 plus NLTK_PATHSEC_ENFORCE=1 with CVE-2026-81726 still open on current, MLflow wants 3.15.0, omnigent wants 0.3.0, orval wants 8.22.0, claude-code-templates wants 1.29.4, @toon-format/toon wants 2.3.1, @openclaw/feishu wants 2026.6.9, pnpm wants 10.34.5 / 11.11.0, nanoid wants 3.3.12 / 5.1.11, fast-uri wants 2.4.5 / 3.1.6 / 4.1.3, @faker-js/faker wants 10.5.0, banks wants 2.4.5, Chainlit wants 2.12.0 or MCP off, PraisonAI wants 4.6.58 with an audit after it, pantheon-agents wants 0.6.4 plus credential rotation, RestrictedPython wants 8.3, the npm MariaDB connector wants 3.2.4 / 3.3.3 / 3.4.6 / 3.5.3, engine.io wants 6.6.7, 9router is fixed for two of eleven at 0.5.2, vm2 wants 3.11.6, xinference wants 2.7.0, jsonata wants 1.8.8 / 2.2.1 with Node-RED still pinned below the floor, MONAI wants 1.6.0, hydra-core wants 1.3.4, Flowise is archived at 3.1.4 with four permanent criticals, mcp-florence2 is vendor-declined, the unfixed MCP servers from August 17 are unchanged, AgenticSeek needs its token set plus a loopback bind, Langflow wants 1.11.3, Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, n8n wants 1.123.69 / 2.33.4 / 2.34.1, SSH.NET wants the 2026.0.0 major, .NET wants 8.0.30 / 9.0.19 / 10.0.11.

Feed notes. GitHub's reviewed npm and pip databases have now published nothing since September 4 — four days, which is longer than a weekend pause and long enough that today's table comes entirely from repository-level advisories. Everything in it arrived outside the reviewed feed, which is the point worth carrying: on the AI stack, the advisories that matter increasingly land where dependency tooling does not look.

Microsoft's September cycle is today and has not shipped yet — the release lands at 10:00 PT, which is this evening in Rome. NuGet has published nothing since the low-severity Magick.NET memory leak on September 2, dotnet/announcements carries nothing for September, and the August 11 .NET batch still stands. Pre-release coverage points at a small Azure, Office and Dynamics set rather than a runtime batch, but nothing is confirmed until MSRC posts it; tomorrow's digest carries whatever actually lands. Angular is unchanged at 22.1.5 from September 3 with no security designation, and PrimeNG has shipped nothing since 21.1.9 in June.

Filtered out and why: @sap/cds-mtxs is a critical on npm published today, and it is SAP's Cloud Application Programming multitenancy extension — real, but not on either tracked stack. The rest of SAP's monthly batch, a run of roughly thirty JetBrains advisories against YouTrack, Hub and the IntelliJ family, twenty-odd Dell SCG appliance entries, GLib2, two Perl modules, Adobe Commerce, jackson-coreutils and json-patch on Java, ASUS Armoury Crate, two D-Link routers, vgmstream and the usual SourceCodester and code-projects PHP entries are all outside scope. mocknest-serverless looked AI-adjacent and is not — it is an AWS OIDC deployment helper with no package ecosystem mapping.

One scoring note. Aggregator pages are carrying the knowns critical as 9.8; the GitHub advisory says 9.3 under CVSS 4.0 with a published vector, and that is the number in the table. If your scanner tells you 9.8 this week, it is reading a rewrite rather than the advisory.