Microsoft's October Patch Tuesday brought 46 .NET advisories, three of them critical: a 9.8 in the QUIC library .NET uses for HTTP/3 on Windows, and two Kestrel request-handling flaws. On the AI side, Xoscar, the actor framework under Xinference, has an unauthenticated 9.8 with no fixed release, and Roo Code, shut down in May with two million installs still on the Marketplace, took five CVEs that will never be fixed. MONAI and IBM ContextForge both need an upgrade you may already have, and ContextForge needs a new secret as well.

Scanners will raise little of this beyond the .NET packages. The runtime, ASP.NET Core and WPF records are in GitHub's database, so NuGetAudit flags them on package references and runtime packs. The six .NET SDK records, all four MsQuic records, MONAI's four and fourteen of ContextForge's fifteen are repository advisories that return 404 there. Xoscar's and Roo Code's are unreviewed CVE records with no package mapping, and NuGet lists no known vulnerability against any Key Vault package version.

Worth your morning

.NET: three criticals, two of them in Kestrel. Microsoft shipped 8.0.32, 9.0.21, 10.0.13 and 11.0 RC2 on October 13 with 46 advisories: 13 for ASP.NET Core, 16 for the runtime, 6 for the SDK and 11 for the WPF desktop runtime. Microsoft lists none as exploited, and one, a 5.3 in the MessagePack-CSharp SignalR protocol (CVE-2026-92707), as publicly disclosed. The three criticals:

• CVE-2026-105016 (9.8): in Microsoft QUIC as .NET 8, 9, 10 and 11 RC2 use it on Windows, a crafted IPv6 QUIC packet that reaches the HTTP/3 path can run code with no authentication.
• CVE-2026-88092 (9.4): after an aborted HTTP/1 connection, Kestrel can treat unread request-body bytes as a new request, which Microsoft describes as a request-smuggling or desynchronization path.
• CVE-2026-70188 (9.1): Kestrel accepts newline characters in HTTP/2 trailers and HPACK header values that it should reject as malformed.

Install the runtime update on every host, or SDK 8.0.426, 9.0.319, 10.0.402 or 11.0.100-rc.2 on build machines, and restart the apps. Self-contained deployments carry their own runtime, so they have to be rebuilt and redeployed. A NuGet audit sees package references and runtime packs, not the shared runtime installed on a server, so check those with dotnet --list-runtimes. Visual Studio 2022 17.14.42 and 2026 18.10.4 carry the same fixes. Two 8.8s in the Blazor WebAssembly debugging tools (CVE-2026-102870, CVE-2026-96230) affect developer machines running dotnet watch or the debug proxy, and an 8.1 in ASP.NET Core Identity (CVE-2026-70175) can send password-reset and confirmation mail to the address in the request instead of the account's stored one. .NET 8 and .NET 9 both reach end of support on November 10, so next month's Patch Tuesday is the last for either.

MsQuic: the same 9.8 for Linux, through a different package. The .NET record for CVE-2026-105016 lists Windows only, because .NET bundles MsQuic there. On Linux, .NET's HTTP/3 support uses the libmsquic package from Microsoft's repository, and the MsQuic project's own advisories, published at 23:31 UTC, put the 9.8 and three more flaws in every MsQuic build before 2.5.12 and 2.6.3. The others are CVE-2026-100219 (9.1 from the project, 9.8 from Microsoft for Windows' built-in QUIC), a use-after-free in initial connection handling, a 7.5 use-after-free and a 7.5 bypass of the anti-amplification limit. libmsquic 2.6.3 is in Microsoft's Ubuntu 24.04 repository now. Windows' own QUIC stack is fixed by this month's cumulative updates. GitHub's record for the .NET advisory maps only one CI build of the Microsoft.Native.Quic.MsQuic.Schannel package, and the project's four records return 404 in GitHub's database, so no scanner will tell you a Linux host is still on 2.6.2.

Xoscar: an unauthenticated 9.8 under Xinference, no release with a fix. VulnCheck filed CVE-2026-49950 (9.8; 9.3 on v4) last night for Xoscar, the actor framework Xinference runs on. Anyone who can reach an actor pool's TCP port can run code on the host. The record covers everything through 0.11.2, the newest release (October 7), and the project hasn't published an advisory or an issue about it. Xinference 4.0.0 (October 9) requires xoscar>=0.10.0, so a fresh install resolves to an affected version. In Xinference the actor pools are what --supervisor-port and --worker-port open, separate from the REST API port. Keep those ports on a network only your Xinference nodes can reach, and on a single machine bind them to loopback. This is VulnCheck's finding, not yet confirmed by the maintainers.

Roo Code: five CVEs for an extension that no longer exists. VulnCheck filed CVE-2026-110202 to CVE-2026-110206 (each 8.8; 7.7 on v4) against Roo Code through 3.54.0. Each one lets a shell command the user's rules deny be approved automatically, and the records say a prompt injection in content the agent reads is enough to trigger it. Roo Code's README says the extension was shut down on May 15. The repository is archived, and 3.54.0 is still on the VS Code Marketplace with 2.07 million installs. There won't be a fix. Remove it, and until you do, turn off automatic approval for commands. Shutting down an extension stops the fixes but not the installs.

MONAI: four advisories, fixed in 1.6.1 with two caveats. MONAI, the medical-imaging AI framework, published four advisories yesterday afternoon. A malicious or compromised aggregation server can run code on every federated-learning client (GHSA-x6pr, 9.8). A crafted DICOM upload can crash MONAILabel's inference pipeline or silently corrupt its segmentation output (CVE-2026-48705, 9.3). A bundle's logging configuration can run code when the bundle loads (GHSA-wvpx, 8.8), and model downloads with no hash pass the integrity check (GHSA-hhh4, 7.4). The fix commits, merged between August 29 and September 17, are all in the 1.6.1 tag (September 27). Three of the advisories give their fixed version as <= 1.6.1, which reads as though 1.6.1 were affected. It isn't.

1.6.1 handles two of the four with a warning rather than a block. Federated clients still run the bundle configuration the server provisions, with a warning, but no longer apply its logging file by default. check_hash still returns true when no hash is given, also with a warning, though the default algorithm is now SHA-256. Upgrade, connect federated clients only to aggregation servers you control, and pass an explicit hash for every download.

ContextForge: fifteen advisories from August, and a 1.0.3 floor that was too low. NVD published CVE-2026-53709 (9.8) yesterday for IBM's MCP gateway, a June advisory fixed in 1.0.2. Pulling the repository's full list showed fifteen advisories from August 24 to September 7 that this digest never covered. Thirteen need more than the 1.0.3 this digest has given since August 22. The worst is a default JWT secret shipped in the Docker Compose files that lets anyone who reaches the gateway mint platform-admin tokens (GHSA-8pcq, 9.8, fixed 1.0.7). Next come an SSRF in the bundled URL-to-Markdown server (9.1, fixed 1.0.7) and a predictable default signing key accepted in the default environment (8.9, fixed 1.0.7). The highest boundary is 1.0.8, and the newest release is 1.0.11 (September 28). Only one of the fifteen, the RestrictedPython sandbox bypass (CVE-2026-53710, 10.0, fixed 1.0.2), is in GitHub's database, so a scanner calls 1.0.3 clean.

Upgrading alone doesn't help a deployment still signing with the shipped key. Set a long random JWT_SECRET_KEY of your own, which signs everyone out, and if the gateway was reachable with the default, rotate the credentials it stores for its MCP servers. PyPI also carries a 1.0.7.post20260921 build from September 21, which sorts below 1.0.8. Take 1.0.11.

Paperwork your scanner may raise.

• Payload CVE-2026-63316 (8.7 v4), from CERT Polska: SQL injection through the in and not_in query operators. It is the same flaw as GHSA-pj7x / CVE-2026-105856, fixed in 3.90.0, the floor since October 7. That makes two CVE identifiers for one fix.
• Mistral Vibe CVE-2026-109429 (8.8; 8.7 on v4): a bypass of the Bash permission gate, fixed in 2.25.4 on September 12. 2.26.1 is current.
• heym CVE-2026-55376 (8.8): fixed in 0.0.40, below the 0.0.109 floor from September 27.

The rest of the new records.

• Claude Desktop on Windows (CVE-2026-88066, 7.5 v4): before 1.8089.0, opening a project folder that contains a malicious git.exe could run it. Auto-updating installs already have the fix. Check the version if you update by hand.
• Kubeflow Model Registry (CVE-2026-110220, 7.1): through 0.3.17 (September 21, the newest), a user who can create InferenceServices in a namespace can get the controller's ServiceAccount token sent to a URL they choose. No fix yet. Limit who can create or annotate InferenceServices, and give the controller's account no more than it needs. The repository also has two July advisories this digest missed, a 9.9 that left the Model Registry server reachable and writable (CVE-2026-63631) and an 8.4 (CVE-2026-71860), both fixed in 0.3.11.
• ToolHive operator (GHSA-756x, 6.5): anyone allowed to create an MCPServer resource can stall the shared operator for every namespace. Fixed in 0.53.0 (October 13), which turns spec.permissionProfile into a no-op. The floor for operator users moves from yesterday's 0.52.0.
• Conductor (conductor-oss): three VulDB records against its MCP and A2A agent endpoints, 5.3 to 7.3 (2.1 to 5.5 on v4), no fixed release named.

Standing items. LiteLLM 1.105.1, released at 04:27 UTC today, still has no email_verified check in its JWT auth code, so CVE-2026-93355 stays open on JWT-auth deployments. LobsterAI 2026.10.13, out at 06:48 UTC, contains the merge of PR 2809, so CVE-2026-108156 now has a release to install. MLflow 3.17.1 shipped yesterday, and the floor stays 3.17.0. The Milvus Helm chart 5.0.31 still pins Attu v2.5.3, off by default. vLLM's newest release is still 0.31.0, and PR 51504 is merged but in no release. Unchanged since yesterday: SGLang 0.5.21, BotSharp 5.2.0, Unla 0.10.0, Plano 0.4.37, mcp-go 1.2.1, the MCP Kotlin SDK 0.15.0, mistral.rs 0.9.4, mcp-remote 0.14.3, Vearch 3.5.9, openapi-typescript-codegen 0.31.0, AstronRPA 1.1.6, Chroma 1.5.9, MarkItDown 0.1.8, Mooncake 0.3.13.post1, pandas-ai 3.0.0 and LightLLM v1.2.0. BrowserSkill PR 363 is unmerged, @deepseek-ai/dsh-client-connection's latest tag still points at the affected 0.0.1-rc.1, and hyper-mcp has only nightly builds after 0.8.3. Apart from Microsoft's 40 records, GitHub's reviewed feed has published nothing since Friday 20:57 UTC.

For .NET and Azure. Beyond the runtime, PowerShell 7.4.21, 7.5.12 and 7.6.7 fix an 8.8 (CVE-2026-96251). Visual Studio Code 1.141.1 (October 13) fixes ten CVEs, the highest a 9.6 (CVE-2026-102238), none exploited. The Key Vault row covers two records. The 8.2 (CVE-2026-85925) is fixed in Keys 4.10.1, Secrets 4.11.1, Certificates 4.9.1 and Administration 4.8.1 (September 3), and the 5.9 (CVE-2026-88132) needs the October 2 and 3 releases named in the table. Python's azure-keyvault-* packages need 4.11.2 (administration 4.7.1) for a separate 7.4 (CVE-2026-85922), and the Java azure-storage-blob-batch library needs 12.31.2 for an 8.1 (CVE-2026-88094). Azure SRE Agent's 9.6 and Event Grid's 7.7 were service-side and covered on October 9. No Angular or PrimeNG advisories today.