Patch Tuesday's lead turned up a day early and not from Microsoft. GitLab released 19.4.2, 19.3.5 and 19.2.8 on Monday, fixing a 10.0 that lets an unauthenticated user run code on a self-managed server, with two Duo Agent Platform records in the same release. SGLang took five new memory-exhaustion CVEs with no fix, and MLflow, ToolHive and simple-git have patches to pick up. Microsoft's own Patch Tuesday documents weren't published when this ran.

SGLang's five and GPT-SoVITS's are unreviewed CVE records with no package mapping, and MLflow's and ToolHive's are repository advisories that return 404 in GitHub's database, so no dependency scanner will raise any of them yet. simple-git's four are mapped to the npm packages in GitHub's database, so npm audit raises them.

Worth your morning

GitLab: a 10.0 with no login, and two AI records next to it. CVE-2026-97229 (10.0) covers GitLab CE and EE 19.2 and later. Insufficient validation of regular expressions in CI/CD configuration can, under certain conditions, let an unauthenticated user run code on the GitLab server. The fixed releases are 19.4.2, 19.3.5 and 19.2.8, and GitLab's release post doesn't say the flaw is exploited. The score is GitLab's own; NVD hadn't analysed the record yet. Two records concern the Duo Agent Platform in EE. CVE-2026-96893 (7.3) lets an authenticated user inject content into AI agent instructions, which can cause commands to run that are attributed to other users, and CVE-2026-105458 (4.3) is a governance-control bypass. Both start at 19.1, and the release names no 19.1 fix, so 19.1 means moving to 19.2.8 or later. The release carries 24 fixes: one critical, five high. The other four highs are a cross-site scripting issue (8.7), two authorization flaws in pipeline creation and scheduled pipeline execution policies (8.5 and 7.7) and a file-access issue (8.2).

GitLab isn't on this digest's lists. It's here because a 10.0 that needs no account is what everyone running it patches today, and two of the records sit in an AI agent product. If you run the self-hosted AI Gateway, its newest tags are still self-hosted-v19.3.2-ee and self-hosted-v19.2.4-ee from September 17.

SGLang: five ways to run a server out of memory, and a 9.8 still open. VulnCheck filed CVE-2026-109225 to CVE-2026-109229 (each 7.5; 8.7 on v4) on Sunday from five issues opened the day before (43705, 43707, 43708, 43709, 43710). A remote client can exhaust memory with oversized transcription uploads, highly compressed audio, full-resolution video frames, or video limits the request itself supplies. A fifth record covers one vision processor that turns off Pillow's decompression-bomb protection for the whole process. All five say "through 0.5.21", the newest release, and the multimodal processors they cite have no commits since it. All five issues are open.

Put authentication and a request-size cap in front of SGLang (client_max_body_size in nginx), keep multimodal endpoints away from callers you don't trust, and run it under a memory limit so a runaway request restarts one container and not the host. SGLang's CVE-2026-93034 is a separate matter: the 9.8 from the earlier digests is still open, and the code it names is still present at v0.5.21 and on main.

MLflow: two more records on the 3.17.0 fix. MLflow published GHSA-m65p-9j7q-6w33 (7.5, arbitrary file read on an unauthenticated server, 3.10.0 up to 3.17.0) at 05:56 UTC and GHSA-j7qq-vr8c-xvw3 (6.5, 2.19.0 up to 3.17.0) at 03:44 UTC, six days after 3.17.0 reached PyPI. The 3.17.0 notes list the matching changes (#25870 for prompt model-version sources, and #25845, which names GHSA-j7qq), and both pull requests are in the v3.17.0 tag. 3.17.0 is also the floor this digest gave on October 10 for the 9.8. The second record says mlflow.crewai.autolog wrote LLM provider API keys into trace spans. If you used it before 3.17.0, rotate those keys and purge the spans. The 3.17.0 notes also cite two advisories that aren't published yet, GHSA-2wqp and GHSA-c8c4.

ToolHive: the July isolation fix left a gap, closed in 0.52.0. GHSA-hfmx-2rf9-m35g (6.3) covers ToolHive's Docker network isolation for MCP servers. Its range starts at 0.30.1, the version that fixed CVE-2026-58197 on the same boundary. A malicious or compromised MCP workload can still reach, through the egress proxy, a service on a Docker bridge gateway that ToolHive's deny rules missed. The advisory says it isn't a container escape. 0.52.0 (October 12, 17:37 UTC) fixes it, and the floor moves from 0.51.4. Until you can upgrade, bind sensitive host services to loopback, reject traffic from container bridge networks with a host firewall rule, and avoid insecure_allow_all and port-only outbound profiles.

simple-git: four advisories this digest missed on October 5. simple-git, with 12.5 million downloads a week, has four records from September 26, in GitHub's database since October 5. Two (8.1 each) are gaps in its unsafe-operations guard in everything through 3.36.0, fixed in 4.0.0. A third (critical, 9.2 on v4) is another gap in the same guard from 3.15.0 up to 4.0.1, and the fourth, in @simple-git/argv-parser through 2.0.1, is a missing environment-variable check. The advisories' own impact section limits all of this to applications that pass untrusted configuration or command arguments to simple-git, so the exposure is whatever feeds it.

The floor is 4.0.2 (September 26), the first release that pins argv-parser 2.0.1; 4.0.1 pins 2.0.0. There is no 3.x fix: 3.36.0 (April 12) is the last 3.x, and it depends on @simple-git/argv-parser ^1.1.0, whose newest 1.x is 1.1.1. Anything that pins simple-git to ^3 can't reach the fix by upgrading, so run npm ls simple-git and look for the tools that do.

GPT-SoVITS: a 9.8 in the voice-model WebUI, no release since June 2025. CVE-2025-71429 (9.8; 9.3 on v4) covers GPT-SoVITS (62,700 stars), the voice-cloning and speech toolkit. VulnCheck says an unauthenticated user who can reach its UVR5 vocal-separation WebUI can run commands on the host through the output folder field. The record covers everything through 20250606v2pro, the newest release. The report has been open since April 2025 with no replies, and the file the record cites has had one commit since the release, titled as an install-script fix. This is VulnCheck's finding and the maintainers haven't confirmed it. Run the WebUI on loopback or behind an authenticating proxy, and in a container with no access to anything you keep.

Paperwork your scanner may raise. VulnCheck filed 19 CVEs for Open WebUI yesterday evening and overnight, one for each of the 19 repository advisories from September 27 and 28. Every one says "before 0.11.4", the floor this digest has carried since then, and none has a package mapping. VulnCheck's scores run from 2.3 to 8.6 on v4, and it scores the DOCX-preview item at 7.3 (8.4 on v4), where the maintainers said 8.7. If you're choosing a target, take 0.12.0 (October 10), not 0.11.4: its notes say it includes security fixes that aren't all enumerated and that some are withheld for a short time so administrators can upgrade. The same notes say the key Open WebUI generates when WEBUI_SECRET_KEY is unset now comes from a cryptographically secure random source, so if an older instance has been running on a generated key, set your own long random value. Changing it signs everyone out.

Other identifiers that point to old fixes:

• vLLM CVE-2026-109311 (6.5; 7.1 on v4): before 0.29.0, an FFmpeg parser memory flaw reachable through audio transcription uploads, fixed in 0.29.0. It is the repository advisory from September 28.
• Ollama CVE-2026-108836 (7.3; 5.5 on v4, from VulDB): an SSRF in the pull API through 0.34.1, fixed in 0.34.2. The 0.35.0 floor stands, and 0.40.3 is current.
• nginx-ui: GitHub assigned four CVEs yesterday evening to July advisories about its MCP endpoints skipping checks that the REST API enforces (CVE-2026-84317, 84318, 84319 and 84360, 8.1 to 8.8). They name 2.4.1. Current is 2.8.4, above the highest fix the repository's advisories name (2.7.0).
• obsidian-tc, an MCP server for Obsidian vaults (691 downloads a week): five CVEs for July's 1.3.1 fixes, two of them critical (9.9 and 9.6 on the maintainers' scores). Current is 1.33.0.
• PraisonAI CVE-2026-57143 (8.8): SearxNG SSRF, fixed in praisonaiagents 1.6.62, below the 1.6.78 floor this digest carries.

The rest of the new records.

• Continue CLI (7.5; 7.7 on v4), 4,000 downloads a week: through 1.5.47 (June 18, the newest), a Bash permission rule that allows a command prefix also approves commands chained after it. Issue 13288 has been open since September 17. Treat an allowed prefix as permission for whatever follows it, and narrow the rules to exact commands. CVE-2026-109560
• Agno (7.3; 5.5 on v4, from VulDB): through 3.1.1, code-executing tools run without a confirmation step by default. PR 10523, which requires confirmation by default, is open, and 3.1.3 (October 12) doesn't include it. Turn confirmation on for code-executing tools in your own agents. CVE-2026-108819
• JeecgBoot (4.3 to 6.5; 7.1 on v4 for two): 13 records for missing permission checks on its AI and RAG endpoints, each needing a signed-in user. Everything through 3.9.5 (August 27, the newest) is affected, with no fixed release.

Standing items. vLLM's newest release is still 0.31.0; PR 51504 is merged but in no tag, and v0.31.1rc0 carries the CVE-2026-90878 fix without being on PyPI. LiteLLM has no stable release after 1.105.0, so CVE-2026-93355 stays open on JWT-auth deployments. MLflow's floor is 3.17.0. Unchanged since yesterday: BotSharp 5.2.0, Unla 0.10.0, Plano 0.4.37, mcp-go 1.2.1, the MCP Kotlin SDK 0.15.0, mistral.rs 0.9.4, mcp-remote 0.14.3, Vearch 3.5.9, openapi-typescript-codegen 0.31.0, AstronRPA 1.1.6, LobsterAI 2026.9.23, the Cohere SDK 7.2.0, Chroma 1.5.9, MarkItDown 0.1.8, Mooncake 0.3.13.post1, pandas-ai 3.0.0, LightLLM v1.2.0, Showdown 2.1.0, NeMo 3.0.0 and the Milvus Helm chart 5.0.30. hyper-mcp has had a nightly build today but no commit to src/wasm/oci.rs, where its signature check lives, since June 24, and cc-connect has only betas after 1.5.0. BrowserSkill PR 363 is unmerged, and the latest tag of @deepseek-ai/dsh-client-connection still points at the affected 0.0.1-rc.1. GitHub's reviewed feed has published nothing since Friday 20:57 UTC.

For .NET and Azure. simple-git is today's npm item. Microsoft hasn't revised a .NET, ASP.NET Core or Azure-service document since the October 8 batch (Azure App Service CVE-2026-77900 and API Center CVE-2026-83943, covered on October 9, both fixed on Microsoft's side). Patch Tuesday's documents weren't published when this ran. GitHub's record for the Handlebars critical GHSA-p8wg now says >= 3.0.0, <= 4.7.9, matching the repository, so scanners flag 3.x as well. One of ImageSharp's eight records, the CCITT one (GHSA-jj3q, 7.5), now names 3.2.0 and 4.1.1, under the package id ImageSharp instead of SixLabors.ImageSharp, so NuGetAudit won't raise it. The other seven still name only 4.1.2, and NuGet's catalog still lists five known vulnerabilities on 3.2.0. For Angular teams, GitHub's record for webpack-dev-middleware GHSA-g84c still says < 7.4.5.