Four Angular advisories entered the reviewed npm feed yesterday, two of them at 8.6. Both were fixed on August 27, disclosed the same day on the Angular repository, and invisible to dependency tooling until the review landed — so this digest reported those releases as carrying no security designation, which was true of every feed it could see. The unfixed item this morning is OmniRoute, a 9.5 with no patched release. Behind them, n8n publishes sixteen advisories at once and Open WebUI adds fifteen to a release you already have.

Worth your morning

Angular — fixed on August 27, told to your scanner on September 10. Two highs, both scoring 8.6 under CVSS 4.0, both requiring server-side rendering. CVE-2026-88060 is cross-site scripting (CWE-79) in SSR HTML serialization, where escaping fails across <template> boundaries inside fallback raw-content elements. CVE-2026-88056 is server-side request forgery with cross-origin credential disclosure (CWE-918), rooted in a mismatch between Angular's SSR URL resolution and WHATWG URL parsing — Angular's utility trimmed Unicode whitespace that the standard treats differently, so a URL your application checked as same-origin could resolve as something else. Both close in 22.1.4, 21.2.22 and 20.3.30.

Two things narrow this. The first is SSR: both highs live in @angular/platform-server. A client-rendered SPA that never imports it is not exposed to either, and the SSRF additionally needs user-controlled input reaching HttpClient resource URLs. The second is timing, in your favour. Those patched versions shipped on August 26 and 27. Current is 22.1.6 / 21.2.23 / 20.3.31 from September 9, so anyone who has updated since late August closed both before the advisory named them.

The gap is the part to keep. Angular published these on its repository on August 27, the same day the fix shipped — no delay, no silence, full disclosure. The reviewed npm database picked them up fifteen days later, and a dependency scanner only reads the second one. This digest's September 9 and 10 editions reported Angular's releases as carrying no security designation; the designation existed, one feed over. That is the third variation on this failure in a week, after Next.js's fourteen-day wait and Microsoft QUIC's month, and it is the least excusable of the three, because nothing was late except the indexing.

The item without an exit is Angular 19 and earlier. All four advisories list <= 19.2.25 as affected with no patched version, and 19.2.25 was the line's final release in June. There is no fix coming. An SSR deployment on v19 needs the vendor's stated mitigation instead — normalise whitespace consistently across URL validation and processing, and reject Unicode whitespace before any origin check — or a major-version move.

OmniRoute — a 9.5 with nowhere to upgrade to. CVE-2026-88062 is remote code execution through the agent-management API of OmniRoute, a platform for running custom agents and CLI tools over ACP. Affected is 3.8.50 and below, which is every release including the current one, published August 28. CWE-94 and CWE-306, scored 9.5 critical. It is unauthenticated when requireLogin=false, and unauthenticated during the bootstrap window before a management password is set — after that it needs credentials, which is the whole of the available mitigation.

No patched version exists. The package pulls roughly 38,000 downloads a week, which is too many for an unfixed critical on a component whose job is to hold credentials for other agents. Until there is a release: set the management password, bind it to loopback or put it behind your own authenticating proxy, and keep the API off any network segment you do not control. Treat an instance that ran with requireLogin=false on a reachable interface as needing a credential rotation rather than just an upgrade.

n8n — sixteen advisories, one upgrade. Five highs and eleven moderates, all dated September 10. The highs: two expression-sandbox escapes reaching code execution (CVE-2026-86083, CVE-2026-86076), a domain-restriction bypass on an unguarded model-search endpoint in the OpenAI Chat Model node (CVE-2026-86082), regular-expression denial of service in the default blocked-file-pattern match (CVE-2026-86081), and unauthenticated storage exhaustion through the OAuth dynamic client registration endpoint (CVE-2026-86075).

The moderates are mostly tenancy: cross-tenant member PII through a missing per-project scope check, cross-user workflow disclosure through a missing userId filter, chat injection into another user's folder, an admin demoted by SSO role sync keeping write access, disabled OIDC endpoints still issuing valid sessions, and a GitHub trigger path that skips webhook secret storage so signature verification fails open.

Fixed versions are 1.123.76 on the maintenance line, 2.37.7 on 2.37 and 2.38.2 on 2.38; current is 1.123.79 / 2.38.6 / 2.39.2, and the 2.39 line is outside every affected range. The standing floor of 1.123.69 / 2.33.4 / 2.34.1 is superseded by a wide margin. None of the releases that carry these fixes mention security in their notes, so the version number is again the only signal. The population that should read the tenancy items twice is anyone running one n8n instance for several teams.

payload-alt-text-plugin — an access-control parameter whose default is to not control access. CVE-2026-59965 scores 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, CWE-863). The plugin generates alt text and keywords for Payload CMS media uploads, and its endpoints call Payload's Local API without passing overrideAccess: false. The parameter defaults to true, so collection-level access control is skipped: any authenticated user, at any role, can read protected upload documents and write the alt and keywords fields on records their permissions cover.

Affected is 0.7.0 and below. The advisory records no patched version, which needs reading carefully rather than as an all-clear — releases above the declared range exist, and 0.12.0 shipped on September 9. Moving to current puts you outside what the maintainer declared affected, but no release is marked as the fix, so verify the parameter in your own deployment rather than trusting the version string. Volume is small at about 440 downloads a week. It earns a row because the failure mode generalises: any Payload plugin reaching the Local API on a user's behalf has the same default waiting for it, and this digest's audience runs more Payload than the download count suggests.

Open WebUI — twenty-six advisories, twelve days, one release. Fifteen more landed yesterday, and every one closes at 0.11.1. The top of the batch is CVE-2026-87995 at 8.7, same-origin XSS reaching account takeover through a terminal port-preview iframe that hardcodes allow-same-origin, and CVE-2026-87016 at 8.1, where wildcard characters in an OAuth subject claim allow signing in as another user on SQLite deployments. Four more highs: SSRF into internal services through DNS rebinding in the Playwright web loader (7.7), non-admin deletion of admin-owned external knowledge connections (7.1), authenticated server-side fetch reaching the Azure platform channel (7.1), and unauthenticated server stalling through uncached OIDC fetches in back-channel logout (7.5).

That brings the count since August 30 to twenty-six advisories against a release that shipped on August 25 and has been this digest's standing floor since September 7. The maintainer is clearing a coordinated-disclosure queue behind a fix, which is the correct order. Current is 0.11.3. Anyone on the floor has had nothing to do for two weeks and still has nothing to do.

Standing items

Milvus, day thirty-one. CVE-2026-69111 (8.7) is unchanged. PR #49847 is still open with one approval, Code-Check still failing, no activity since August 14 — twenty-eight days. The authentication it adds is opt-in behind common.security.adminAuthEnabled, so a merge alone closes nothing. Port 9091 stays firewalled.

New floors from today. Angular wants 22.1.4 / 21.2.22 / 20.3.30 with 22.1.6 / 21.2.23 / 20.3.31 current and no fix on v19 or earlier; n8n wants 1.123.76 / 2.37.7 / 2.38.2; omniroute has no fix at any version and wants network isolation plus a management password; payload-alt-text-plugin wants 0.12.0 and a manual check.

.NET. The 8.0.31 / 9.0.20 / 10.0.12 runtime floor stands, with SDK 9.0.317 / 10.0.111 / 10.0.400 on Linux. One correction to September 9: the Microsoft.DiaSymReader.Native 8.8 carries three identifiers, not two — CVE-2026-69439 sits alongside CVE-2026-71328 and CVE-2026-69522, all fixed in the same 18.9.0-beta1.26405.2. One fix, three CVEs, no extra work.

Carried unchanged from September 10: Microsoft QUIC wants 2.5.10 / 2.4.19 or a current Windows cumulative with HTTP/3 worth confirming, smol-toml wants 1.7.1, @openhop/server wants 0.3.6, functype-mcp-server wants 1.4.4, nuxt-ollama wants 1.3.1 plus a key rotation, Next.js wants 15.5.24 / 16.3.3 with AVIF optimization disabled rather than fixed, GitPython wants 3.1.59, winml-cli wants 0.4.0, Ollama wants 0.33.3 with five highs and a low on a record your tooling cannot see, knowns wants 0.30.0 as the floor with 0.33.0 current and the outbound-fetch item still unfixed on it, llama.cpp's RPC server has no fix and wants a loopback bind, Open WebUI wants 0.11.1 with 0.11.3 current, OpenMAIC wants 1.0.1, Bifrost wants transports/v2.0.0 or management auth on, nbviewer is commit-only with no release, rowboat has no fix and wants egress rules, openagents is vendor-declined, codewhale wants 0.8.64 with the cargo deepseek-tui crate still unfixed, vLLM wants 0.28.0, @typespec/spector wants 0.1.0-alpha.27, unstructured wants 0.24.0, NLTK wants 3.10.3 plus NLTK_PATHSEC_ENFORCE=1 with CVE-2026-81726 still open on current, MLflow wants 3.15.0, omnigent wants 0.3.0, orval wants 8.22.0, claude-code-templates wants 1.29.4, @toon-format/toon wants 2.3.1, @openclaw/feishu wants 2026.6.9, pnpm wants 10.34.5 / 11.11.0, nanoid wants 3.3.12 / 5.1.11, fast-uri wants 2.4.5 / 3.1.6 / 4.1.3, @faker-js/faker wants 10.5.0, banks wants 2.4.5, Chainlit wants 2.12.0 or MCP off, PraisonAI wants 4.6.58 with an audit after it, pantheon-agents wants 0.6.4 plus credential rotation, RestrictedPython wants 8.3, the npm MariaDB connector wants 3.2.4 / 3.3.3 / 3.4.6 / 3.5.3, engine.io wants 6.6.7, 9router is fixed for two of eleven at 0.5.2, vm2 wants 3.11.6, xinference wants 2.7.0, jsonata wants 1.8.8 / 2.2.1 with Node-RED still pinned below the floor, MONAI wants 1.6.0, hydra-core wants 1.3.4, Flowise is archived at 3.1.4 with four permanent criticals, mcp-florence2 is vendor-declined, the unfixed MCP servers from August 17 are unchanged, AgenticSeek needs its token set plus a loopback bind, Langflow wants 1.11.3, Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, SSH.NET wants the 2026.0.0 major. The .NET WPF and SourceLink items mapped into NuGet on Tuesday remain scanner noise against the current floor, except the SourceLink 10.0.200–10.0.204 band, which still has no fixed version.

Feed notes. PrimeNG shipped 22.1.1 and 21.1.10 on September 9 — its first releases since June — with no security designation on either, and no PrimeNG advisory has entered the npm database. NuGet has published nothing since the September 9 .NET batch. CISA added four entries to the Known Exploited Vulnerabilities catalogue since yesterday: two MikroTik RouterOS flaws on September 10 due September 13, and Cisco Secure Firewall Management Center plus Fortinet and Citrix items on September 9 due September 12. None touch either tracked stack, though the three-day deadlines apply if any of that sits on your perimeter.

Filtered out and why. @argos-ci/core at 7.5 is command injection through a CI branch name, fixed in 6.2.1 — real, and visual-regression CI is neither stack. @eigenpal/docx-editor-react at 8.1 is fixed in 1.8.3 and is a document editor. vLLM's 7.5 availability item from September 3 is already carried and closes at the standing 0.28.0 floor. The ESPHome, weasyprint, SQLAdmin, GitHacker and HTTPX2 rows were covered and dismissed on previous mornings and have not changed. Ollama and llama.cpp published nothing new at repository level.