Yesterday the npm and pip feeds flushed a two-week backlog. Today it is NuGet's turn, and the backfill is carrying a critical: CVE-2026-62815, an unauthenticated remote code execution flaw in Microsoft QUIC scored 9.8 on CVSS 3.1 and a flat 10.0 on 4.0. Microsoft published it on August 11 and patched it the same day. The .NET side of the house was told on Tuesday evening. Behind it, smol-toml — thirty-one million downloads a week — patches a parser hang, and Open WebUI adds four more advisories to a release you already have.

Worth your morning

Microsoft QUIC — a critical that took a month to find the .NET feed. CVE-2026-62815 is a use-after-free (CWE-416) in Microsoft QUIC. AV:N/AC:L/PR:N/UI:N with high impact across confidentiality, integrity and availability: no authentication, no user interaction, code execution over the network. 9.8 on CVSS 3.1, 10.0 on 4.0. MSRC marks it neither publicly disclosed nor exploited, and rates exploitability unproven.

Where it lives decides what you do. On Windows the affected component is the in-box msquic.dll, and MSRC lists Windows 11 23H2 through 26H1 and Windows Server 2022 and 2025 as affected — all fixed by the August 11 cumulative (KB5120242 on Server 2022, KB5120233 on Server 2025, KB5121003 on Windows 11 24H2/25H2), superseded again by Tuesday's September drop. If your hosts took either month's update, this is already closed and today is a paperwork exercise.

What is new is the packaging. On Tuesday the advisory was mapped onto Microsoft.Native.Quic.MsQuic.OpenSSL and Microsoft.Native.Quic.MsQuic.Schannel, fixed at 2.5.10 on the current line and 2.4.19 on the 2.4 line. That matters for anything that carries its own msquic rather than the one Windows ships: a project referencing the native package directly, or a Linux .NET host where HTTP/3 requires the libmsquic package from Microsoft's feed and gets patched by the OS, not by the runtime. Self-contained deployments need a rebuild.

The narrowing detail is the same one this digest gave in August for the other QUIC flaw: msquic is the HTTP/3 transport, and Kestrel does not enable HTTP/3 by default. An estate that never turned it on was never reachable this way. Confirm that rather than assume it — the check is cheaper than the alternative.

The reason it went unremarked for a month is worth holding onto, because it is not the same failure as yesterday's. Yesterday's Next.js criticals existed as vendor advisories and waited on a review queue. This one never entered the .NET disclosure channel at all: it is absent from dotnet/announcements in both the August and September batches, because Microsoft classed it as a Windows platform item rather than a .NET one. It was correct to file it there and it was also invisible to every .NET team reading the .NET feed.

Open WebUI — one release, eleven advisories, eleven days. Four more landed yesterday: three through the reviewed pip feed (CVE-2026-88000 and CVE-2026-88002, both 6.5 availability items where an authenticated user can hang the server through a cyclic chat structure, and CVE-2026-88001 at 5.0, where server-side fetches reach internal hosts through unvalidated redirect targets) and one repository-level (GHSA-wvm9-9g5j-623f, where a user the OAuth role policy denies can still sign in through token exchange).

Every one of them closes at 0.11.1. So does everything Open WebUI has published since August 30 — eleven advisories now, including two highs, all pointing at a single release that shipped on August 25 and has been this digest's standing floor since September 7. Anyone who took that floor has nothing to do this morning and has had nothing to do for two weeks. Anyone still on 0.10.x has eleven reasons rather than one.

The pattern is a maintainer clearing a coordinated-disclosure backlog after the fix ships, which is the right order to do it in. It also means the advisory count tells you nothing about your exposure and the version number tells you everything. Current is 0.11.3.

nuxt-ollama — the key goes to the browser. CVE-2026-59158 scores 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The Nuxt Ollama module puts the Ollama API key in the public runtime config, so server-side rendering writes it into the HTML that every unauthenticated visitor receives. Affected is 1.2.26 through 1.3.0, fixed in 1.3.1, current is 1.3.3.

Upgrading stops the leak and does not undo it. Any key served by a public deployment on an affected version should be treated as disclosed and rotated. The module is small — around twenty installs a week — but the failure shape is the one worth recognising, because "public runtime config" is a Nuxt term of art that means exactly what it says and reads like configuration boilerplate on the way past.

smol-toml — small package, large blast radius. CVE-2026-85730 is 8.2 under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H): a malformed TOML document sends the parser into a non-terminating loop and the process stops answering. Availability only, no confidentiality or integrity impact. Affected is 1.7.0 and below, fixed in 1.7.1, and 1.8.0 is current.

It earns a row on reach rather than severity. smol-toml pulls thirty-one million downloads a week and almost none of them are direct — it arrives underneath package managers and build tooling, which is why the fix is a lockfile refresh rather than a decision. The exposure that matters is any service that parses TOML it did not write.

Scanner noise, and one item that is neither

Tuesday's NuGet backfill was not only the September batch. It also mapped older Microsoft CVEs into the package feed for the first time, and two of them will light up a dependency scan this morning without changing anything you should do.

CVE-2026-50646 (7.8) is remote code execution in WPF when parsing crafted XAML, affecting .NET 8, 9 and 10 on Windows. MSRC released it on July 14 and it is fixed in 8.0.29 / 9.0.18 / 10.0.10 — a floor this digest passed on August 12 and has since replaced twice. If you are on yesterday's 8.0.31 / 9.0.20 / 10.0.12, you fixed this two months ago. The GitHub advisory still links its own announcement as dotnet/announcements/issues/**TBD**, which is at least honest about the state of the paperwork.

CVE-2026-62900 (5.9) is the August information-disclosure item in Microsoft.Build.Tasks.Git and Microsoft.SourceLink.AzureRepos.Git, now mapped to NuGet. Read the ranges before you dismiss it: 10.0.102 – 10.0.110 closes at 10.0.111 and 10.0.300 – 10.0.301 at 10.0.303, but 8.0.0 and the 10.0.200 – 10.0.204 band carry no fixed version at all. These are build-time SourceLink packages rather than runtime, so the exposure is your build agents, not production. If you are pinned in the 10.0.2xx band, moving to a fixed line is the only available answer.

Also from yesterday, and not scanner noise: the two Windows zero-days this digest carried on Tenable's count are now in CISA's Known Exploited Vulnerabilities catalogue. CVE-2026-81963 and CVE-2026-85880 were added September 8 with a remediation deadline of September 22. Both are local privilege escalation to SYSTEM and both are being used. That is a firm date on the September cumulative for the Windows hosts under your .NET estate.

One more added September 9, due September 23: CVE-2026-87491, an actively exploited flaw in Chromium's V8 engine. Chrome is outside both tracked stacks and it is in the room anyway — the AI coding tools most of this audience runs are Electron applications carrying their own Chromium, and they inherit V8 defects on the vendor's release cadence rather than Google's. Update the browser today; check what your editor is shipping when it next prompts you.

Standing items

Milvus, day thirty. CVE-2026-69111 (8.7) is unchanged. PR #49847 is still open, still unmerged, no activity since August 14 — twenty-seven days. The fix it contains is opt-in and disabled by default, so merging it will not close this for anyone who does not also turn it on. Port 9091 stays firewalled.

New floors from today. smol-toml wants 1.7.1, @openhop/server wants 0.3.6, functype-mcp-server wants 1.4.4, nuxt-ollama wants 1.3.1 plus a key rotation, and msquic wants 2.5.10 / 2.4.19 or a current Windows cumulative.

.NET. Yesterday's 8.0.31 / 9.0.20 / 10.0.12 stands, with SDK 9.0.317 / 10.0.111 / 10.0.400 on Linux. The WPF and SourceLink items above do not move it.

Carried unchanged from September 9: Next.js wants 15.5.24 / 16.3.3 with AVIF optimization disabled rather than fixed in those releases, GitPython wants 3.1.59, winml-cli wants 0.4.0, Ollama wants 0.33.3 with five highs and a low on a record your tooling cannot see, knowns wants 0.30.0 as the floor with 0.33.0 current and the outbound-fetch item still unfixed on it, llama.cpp's RPC server has no fix and wants a loopback bind, Open WebUI wants 0.11.1 with 0.11.3 current, OpenMAIC wants 1.0.1, Bifrost wants transports/v2.0.0 or management auth on, nbviewer is commit-only with no release, rowboat has no fix and wants egress rules, openagents is vendor-declined, codewhale wants 0.8.64 with the cargo deepseek-tui crate still unfixed, vLLM wants 0.28.0, @typespec/spector wants 0.1.0-alpha.27, unstructured wants 0.24.0, NLTK wants 3.10.3 plus NLTK_PATHSEC_ENFORCE=1 with CVE-2026-81726 still open on current, MLflow wants 3.15.0, omnigent wants 0.3.0, orval wants 8.22.0, claude-code-templates wants 1.29.4, @toon-format/toon wants 2.3.1, @openclaw/feishu wants 2026.6.9, pnpm wants 10.34.5 / 11.11.0, nanoid wants 3.3.12 / 5.1.11, fast-uri wants 2.4.5 / 3.1.6 / 4.1.3, @faker-js/faker wants 10.5.0, banks wants 2.4.5, Chainlit wants 2.12.0 or MCP off, PraisonAI wants 4.6.58 with an audit after it, pantheon-agents wants 0.6.4 plus credential rotation, RestrictedPython wants 8.3, the npm MariaDB connector wants 3.2.4 / 3.3.3 / 3.4.6 / 3.5.3, engine.io wants 6.6.7, 9router is fixed for two of eleven at 0.5.2, vm2 wants 3.11.6, xinference wants 2.7.0, jsonata wants 1.8.8 / 2.2.1 with Node-RED still pinned below the floor, MONAI wants 1.6.0, hydra-core wants 1.3.4, Flowise is archived at 3.1.4 with four permanent criticals, mcp-florence2 is vendor-declined, the unfixed MCP servers from August 17 are unchanged, AgenticSeek needs its token set plus a loopback bind, Langflow wants 1.11.3, Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, n8n wants 1.123.69 / 2.33.4 / 2.34.1, SSH.NET wants the 2026.0.0 major.

Feed notes. Both tracked front-end projects shipped yesterday and neither shipped security. Angular released 22.1.6, 21.2.23 and 20.3.31 on September 9 with no security designation on any of the three. PrimeNG broke a three-month silence with 21.1.10 on September 9 — its first release since 21.1.9 in June — also with no security designation; the project stays security-fix-only and this was not one. As of this morning the reviewed npm and pip databases have published nothing dated September 10, so everything above comes from the September 9 window or from Tuesday's NuGet mapping.

Filtered out and why. @yeger/turbo-graph is the closest miss — 8.8, unauthenticated task execution through an exposed /api/run endpoint, affecting 2.8.8 and below and fixed in 2.8.12, at roughly 1,900 downloads a week. It is a Turborepo task-graph visualiser rather than anything AI, so it sits outside the tracked scope, but the endpoint is reachable from the adjacent network and if it is running on your monorepo the version is worth checking. Also dropped: ESPHome Device Builder at 8.8 (home automation), weasyprint SSRF, SQLAdmin, GitHacker, three LF Edge eKuiper items, containerd's CRI goroutine leak at 6.8, Joker, Komari, webhookd, Identrail and gix-sec — real, none on either stack. SAP's maximum-severity kernel flaw and the Citrix, Fortinet and Cisco KEV additions are outside scope for the same reason, though the Cisco and Citrix deadlines were September 12 if either sits on your perimeter.