Langflow takes a 9.6 this morning and the fix is twelve weeks old. That is the shape of the whole table: seven AI-stack records landed overnight, and every one that has a fix at all was fixed in June, August or early September. The two that have no fix — DocsGPT and Refly — are sitting on their current releases.

Worth your morning

Langflow — a critical that names a fixed version, which is new. CVE-2026-12944 (9.6) covers Langflow OSS 1.0.0 through 1.10.0: an authenticated user reaches arbitrary Python execution on the server, and in the published container that process runs as root. IBM's bulletin names 1.10.1 as the remediation. 1.10.1 shipped June 23, the bulletin went up July 2, and the advisory reached the feed this morning — ten weeks behind the vendor. Current is 1.12.1, out September 8, so anyone tracking releases has been clear since the summer. Two things are worth keeping. This digest wrote on Saturday that not one of Langflow's eight published advisories declares a fixed version; this record does, and the version comes from IBM's bulletin rather than the project's own feed, which remains the only place it has ever been stated. And the root detail belongs to how the image is run, not to the defect — the blast radius is the whole container because nothing in it drops privileges. Worth confirming your compose file names a non-root user whatever version you are on.

wandb — the trust direction is the interesting part. CVE-2026-91771 (8.8 on v3.1, 8.7 on v4) is path traversal in File.download: the client takes the file name out of the server's response and writes it without validating it, so a backend returning a name with traversal segments can place a file outside the download directory. The exposure runs from the server to your machine, which inverts the usual reading — it matters if you point the client at a self-hosted or third-party endpoint, or pull artifacts from a project you do not control. Fixed in 0.29.0 on August 26; 0.30.0 has been current since September 9. On wandb.ai and a current client, this is already closed.

Nothing here will reach your scanner. All seven records are unreviewed GitHub advisories with no package mapping, so no pip or npm feed carries them and no SCA tool will raise them against a lockfile. The reviewed feed itself came back on Sunday afternoon after sixty-six hours of silence and has published six entries since — ZITADEL, ESPHome Device Builder and October CMS — none of which touches the tracked stack. That leaves the two unpatched items to handle by hand. CVE-2026-91201 (5.4 / 5.3) has DocsGPT posting OAuth connector session tokens to a wildcard target origin in its callback-status endpoint, through 0.20.0 — which shipped September 12 and is the current release; until a fix lands, don't authorize new cloud-storage connectors, and re-issue any you granted recently. CVE-2026-91199 (5.0 / 5.3) is SSRF on Refly's scrape endpoint through 1.1.0, reaching loopback, private and link-local addresses; 1.1.0 has been the latest release since February 2, so egress control is the whole remediation.

Two shorter ones. The a2a-java pair (CVE-2026-90819, 7.3 on v3.1 but 6.9 on v4, and CVE-2026-90820, 4.3 / 5.3) both close at 1.3.0.Final from August 27, with 1.3.2.Final current — note that the first is scored high under 3.1 and medium under 4.0, so the label your tooling shows depends on which version it reads. WeKnora (CVE-2026-91750, 6.5 / 7.1) is a redirect that escapes the SSRF check on its knowledge-import endpoint, fixed at 0.7.0 with 0.8.0 current since September 3 — the v4 score crosses into high where the v3.1 score does not.

And one to read carefully. CVE-2026-90878 against vLLM declares an affected range of <= 0.27.1 and, in the same record, that the fix PR awaits acceptance. The PR is open and unmerged, so the upper bound marks where the reporter stopped looking rather than where the defect stops — 0.29.0 does not clear it. Impact is availability on the chat-completions path and the score is 2.1 under v4, so this is a note rather than a morning's work, but it does not belong under the 0.29.0 floor and your scanner will file it there.

Nothing new from Ollama, llama.cpp, LangChain, LlamaIndex, Haystack, LiteLLM, Open WebUI, n8n or the vector databases at repository level. Microsoft revised nine release documents overnight and none of the revisions touched .NET, ASP.NET Core, Azure or Visual Studio — the September 8 Patch Tuesday line stands. Angular is unchanged at 22.1.6, PrimeNG at 21.1.10.