This edition covers the weekend since Saturday's. IBM published a second Langflow bulletin with fourteen CVEs, three at 9.9, all fixed in 1.12.5. DB-GPT has two unauthenticated 9.8s on its newest release, SGLang gained seven flaws with no fix, and MLflow's newest release has an open path traversal on file-backed servers. On the .NET side, Microsoft now says its October fix for CVE-2026-70197 doesn't fix it.

Few scanners will show these as they are. GitHub's database holds one of the fourteen Langflow CVEs and three of the eight aiohttp advisories, and it carries DB-GPT, MLflow and SGLang only as unreviewed records with no package mapping. .NET runs the other way: GitHub's record still lists 8.0.32, 9.0.21 and 10.0.13 as fixed, so an October-patched Windows host scans clean.

Worth your morning

Langflow: a second IBM bulletin, fourteen CVEs, all fixed in 1.12.5. IBM published a second Langflow OSS bulletin yesterday covering 1.0.0 through 1.12.4. Three code-execution flaws score 9.9 (CVE-2026-107327, CVE-2026-107328 and CVE-2026-107329). Each needs only a signed-in account, and the vector marks the impact as reaching beyond Langflow itself. Three more score 8.8 (code or command execution, also any signed-in user). CVE-2026-110245 (7.5) exposes sensitive information without a login, and CVE-2026-107366 (8.3) lets one user delete or overwrite another user's messages. IBM's remediation is 1.12.5, released October 6; 1.12.6 (October 13) is current and carries backports from 1.13.0. Deployments that run MCP servers over stdio should also set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY; IBM says these add to the upgrade and don't replace it. It also says to rotate credentials exposed in previously exported files, because upgrading doesn't remove them (CVE-2026-77817). Only CVE-2026-107366 has reached NVD so far. The floor this digest set on October 7 moves from 1.12.3 to 1.12.5.

DB-GPT: two 9.8s on the newest release, no fix. VulnCheck filed both at 01:17 UTC today. In CVE-2026-77932, the ReAct agent's chat endpoint gets its user from a placeholder lookup that gives every caller the admin role. The agent's code and shell tools run unsandboxed, as root, inside the webserver container, so anyone who reaches the API can run commands. CVE-2026-77933 is the default docker-compose.yml, which sets a fixed MySQL root password and publishes port 3306 on every interface. The same file publishes the webserver on 5670. Both cover releases through 0.8.2 (August 26), the newest. The project (20,000 GitHub stars) has published no advisory. Issue 3167, which reported unauthenticated command execution through the shell tool on July 29, is still open, as are three agent issues filed October 14. Until a fix ships, remove the 3306 mapping, set your own MySQL root password, and bind 5670 to localhost or put it behind an authenticating proxy.

MLflow: an open path traversal on file-backed servers. VulnCheck's CVE-2026-53995 (8.2; 8.8 on v4), filed last night, lets an unauthenticated client write trace metadata files outside the store through the trace API when the server uses the FileStore backend. It covers 3.17.1 and earlier. 3.17.1 (October 13) is the newest release, and the fix, PR 26842, was opened on October 17 and hasn't been merged. The backend decides who is exposed. At 3.17.1, mlflow server defaults to SQLite (sqlite:///mlflow.db). It uses the file store only when an ./mlruns store already exists or when a file path is passed as --backend-store-uri, so deployments that started on ./mlruns keep using it. Move those to a database backend store, or keep them on a private network until a release carries the fix. The 3.17.0 floor from October 10 still stands for the earlier flaws.

SGLang: seven more, none fixed. Five VulnCheck records filed yesterday at 14:17 UTC cover 0.5.22, the newest release:

• one API client can abort other clients' in-flight generations (CVE-2026-112266, 5.9; 8.2 on v4);
• in prefill/decode disaggregation mode, the decode worker opens outbound connections to a host and port taken from the request (CVE-2026-112267, 6.5; 6.9 on v4);
• the model gateway (sgl-model-gateway ≤ 0.3.2) lets a data-plane API key reach its HA management routes, shutdown included (CVE-2026-112268, 6.3; 5.3 on v4);
• with the Mooncake backend, unauthenticated hosts on the same network can exhaust the prefill rank's memory in two ways (CVE-2026-112269 and CVE-2026-112270, 6.5; 7.1 on v4 each).

Two VulDB records from yesterday morning add denial of service through the expert-distribution recording endpoint (CVE-2026-112082, 7.5; 7.7 on v4) and the weight exporter (CVE-2026-112083, 5.3). VulDB says up to 0.5.19, but both fix PRs (42098 and 44314) are unmerged, so 0.5.22 is affected too. The gateway fix (PR 45017) is open, and the other four have issues only. The dumper fix this digest pointed to on Saturday, PR 44782, was closed unmerged by its author this morning, so CVE-2026-111391 has no fix in flight. Keep the disaggregation bootstrap, Mooncake and gateway HA ports on a private network, and on shared deployments have the proxy drop client-supplied rid values.

aiohttp: eight advisories that GitHub rated higher than the maintainers did. aiohttp published eight repository advisories early on October 7, all fixed in 3.14.4, which reached PyPI on October 5. This digest didn't cover them then because aiohttp wasn't on its watch list. The maintainers rated six low and two medium. GitHub's review yesterday rated two high: GHSA-2g87, several unbounded memory and CPU paths (8.7 on v4), and GHSA-5wr8, a server with no timeout for the initial request and headers (8.2 on v4). The rest include request smuggling in the pure-Python parser, file-descriptor exhaustion in multipart handling and connection-pool exhaustion from a cookie Max-Age overflow. Five of the eight aren't in GitHub's database yet. aiohttp sits under much of the Python AI stack, and the dependency floors don't reach the fix. vLLM 0.32.0's security dependency bump requires aiohttp>=3.14.3, LiteLLM 1.106.0 >=3.14.2, OpenAI's aiohttp extra >=3.14.3 and Ray >=3.14.1, so a lockfile already on 3.14.3 stays there. Pin aiohttp>=3.14.4 yourself; 3.14.5 is current.

.NET: Microsoft says the October fix for CVE-2026-70197 doesn't fix it. CVE-2026-70197 (8.1) is an out-of-bounds write in System.Net.Sockets on Windows, reachable by an unauthenticated sender with high attack complexity. Per the advisory, it affects applications that reuse one SocketAsyncEventArgs instance across IPv4 and IPv6 UDP sockets and receive with ReceiveFromAsync. It shipped on October 13 as fixed in 8.0.32, 9.0.21, 10.0.13 and 11.0.0-rc.2, and in Visual Studio 17.14.42 and 18.10.4. Yesterday Microsoft revised the entry to version 2.0, saying the vulnerability "has not been addressed" and that a complete mitigation is being prepared and tested. GitHub's record and the .NET announcement still list those builds as patched. Keep the October update, which fixes the other 45 advisories from October 14. Microsoft hasn't published a workaround. Its own description limits exposure to Windows code that reuses that object across address families, so search your UDP services for that pattern. Linux and macOS aren't listed.

Also on the AI stack.

• Langchain-Chatchat CVE-2026-75128 (9.8; 9.3 on v4): the API's tool-call endpoint has no authentication and the shell tool is always registered, so anyone who reaches it runs commands as the server user, root in the shipped image. It covers releases through 0.3.1.3 (July 2024), the newest. The project (38,700 stars) last saw a commit in November 2025. Keep the API off any network you don't control.
• Letta CVE-2026-77937 (8.1; 8.6 on v4): the legacy Python server through 0.16.8 trusts a user_id header the caller sets, so any API caller can act as another tenant, even with LETTA_SERVER_SECURE on. Letta archived that server's code on August 16 and moved development to letta-code, so 0.16.8 won't be fixed. The letta name on PyPI now installs letta-code 0.34.x, and anything comparing version numbers will call it fixed. The record doesn't say whether the new server is affected. Run the old server single-tenant only.
• Mercury (MLJAR's notebook-to-web-app framework, 4,400 stars): CVE-2026-111057 (10.0, 3.0.0 – 3.2.3, fixed 3.2.4), CVE-2026-111058 (9.8, tokenless default deployments, fixed 3.2.6) and a 6.1 XSS fixed in 3.2.11. All three reached GitHub's database yesterday; 3.2.11 has been out since September 10.
• Xinference CVE-2026-112051 (6.5; 8.3 on v4): on Windows, custom model registration can write and delete .json files outside the model directory without authentication, through 4.0.1. The fix (#5707) merged on October 16, after 4.0.1, and is in no release. On Windows hosts, turn authentication on so registration needs an account.
• Google Agent Mesh CVE-2026-102503 and CVE-2026-103091 (9.3 on v4 each): unauthenticated access to backend services and the MCP proxy in pre-releases up to 0.1.0-alpha.8. Fixed in alpha.3 and alpha.9; 0.1.1 is current.
• crewai-tools CVE-2026-112308 (7.4; 8.3 on v4): SeleniumScrapingTool skips the library's private-address check (validate_url), through 1.15.28, the newest. The fix PR was closed unmerged in August. Don't give agents that tool on hosts that can reach internal services.
• BentoML CVE-2026-112264 (7.8; 8.5 on v4): docker.env keys can add instructions to the generated Dockerfile through the legacy template, through 1.4.39 (May), the newest. It matters if you containerise bentos you didn't write.
• VulnCheck's overnight batch also names small agent apps whose shell or code tools run without the authentication or approval step they advertise: piflow 2.0.0 – 2.0.1 (9.8), Cognition before 0.13.0 (9.8, fixed), JoySafeter, OpenSRE, EvoScientist (fixed in 0.2.5), Aix-DB and LangAlpha (8.1 – 8.8).

Fixed in repository advisories since Saturday. FastMCP GHSA-cg3c (7.5): a regex supplied through RegexSearchTransform can block a worker; fixed in 3.4.9 and 4.1.1 (October 18), so the 4.x floor from Saturday moves from 4.1.0 to 4.1.1. Lobe Chat GHSA-2g9j is labelled medium but describes file write and code execution by any signed-in user on server-database deployments; it was fixed in 2.1.49 in April and 2.2.20 is current. ToolHive ×6 (medium and low) are fixed in 0.55.0 and 0.55.2 (yesterday). Pydantic AI ×2 (6.5, MCP credentials reaching traces; 4.3) are fixed in 2.58.0 and 1.107.8, released this morning. LangGraph CLI GHSA-8prr (5.4) printed the registry push token in langgraph deploy --verbose output; it's fixed in 0.4.32, and you should rotate the token if those logs went anywhere shared. The mistral.rs record ends its range at 0.9.3 and names 0.9.5 (yesterday) as the fix; this digest hasn't checked 0.9.3 and 0.9.4, so take 0.9.5. Docling (4.2, fixed 2.132.0) and Open WebUI (4.3, fixed 0.12.2) round it out. GitHub also reviewed the Envoy AI Gateway's MCP session-resume flaw (6.8 on v4) yesterday. It is one of ten gateway advisories from October 7, all fixed in 1.2.0 that day, among them a 7.5 where CEL evaluation errors in MCP authorization fail open; seven more from late September are fixed in 1.0.0 or 1.1.0. This digest covered none of them at the time, so take 1.2.0. virtualenv published twelve advisories, three of them high (one 7.8, GHSA-c978), that name only 21.14.8 (October 16); 21.14.9 fixed them the next day and 21.14.11 is current.

On the Venicecom stack. picomatch CVE-2026-112366 (7.5; 8.7 on v4) is a regular-expression denial of service through 4.0.7, the newest release, at 316 million downloads a week. PR 194 is open. It matters only where untrusted input becomes a glob pattern. Build tooling such as the Angular CLI compiles patterns from configuration, so check application code that builds globs from requests. The record is unreviewed with no package mapping, so npm audit won't show it yet. fast-uri published four advisories (3.7 – 6.1) yesterday, fixed in 2.4.8, 3.1.9 and 4.2.3, which is the new floor on all three lines. nodemailer's address parser has three 6.5s, fixed in 10.1.4 (October 18).

Paperwork your scanner may raise. GitHub assigned CVEs yesterday to four Angular advisories (CVE-2026-111751 to CVE-2026-111754, covered October 1 and Saturday) and five MCP TypeScript SDK advisories (CVE-2026-111767 to CVE-2026-111771, covered in October). It also assigned five to the A2A Java SDK (CVE-2026-111761 to CVE-2026-111765, including the 7.5 fail-open task authorization). Those were published August 28 and September 9, fixed in 1.3.0.Final (the Android HTTP client in 1.3.2.Final), and this digest didn't cover them at the time. IBM's ContextForge CVE-2026-8355 (SSRF, 0.1.0 – 1.0.5) sits below the 1.0.8 floor from October 14.

Standing items. vLLM 0.32.0 (October 18) is the first PyPI release with the chat-template fix for CVE-2026-90878, which this digest has followed since September; template.rs has the execution limit at the tag and didn't at 0.31.0. It also carries the P2P socket-exhaustion fix (PR 51504), names two advisories that aren't published yet, and stops allowing every origin by default (set --allowed-origins if browsers call it). Its notes link the chat-template fix to GHSA-4hhp-h66f-j5j7, an unrelated image-fetch advisory fixed in 0.26.0. Node.js merged the undici backports into its v22 (October 18) and v24 (October 19) branches, but no 22.x, 24.x or 26.x release carries them yet. Archon 0.12.0 and 0.12.1 (October 17) still bind to 0.0.0.0 by default, so CVE-2026-111322 stays open. LiteLLM 1.106.0 doesn't mention CVE-2026-93355, and it removed a publicly known master key from its examples, so if a deployment uses a key copied from LiteLLM's docs, replace it. NLTK's 3.10.4-rc1, out this morning, names three advisories that aren't published; it's a release candidate. Unchanged: Kubeflow Model Registry 0.3.17, Chroma 1.5.9, Portkey AI Gateway 1.15.2, BotSharp, Unla 0.10.0, Plano 0.4.37, the MCP Kotlin SDK 0.15.0, Vearch 3.5.9, openapi-typescript-codegen 0.31.0, cc-connect, AstronRPA 1.1.6, Mooncake 0.3.13.post1, pandas-ai 3.0.0, LightLLM v1.2.0, GPT-SoVITS, mcp-remote 0.15.1, BrowserSkill (PR 363 unmerged) and hyper-mcp (nightlies only). n8n 2.43.8 and 2.44.4 and the GitLab MCP server 2.3.3 and 2.3.4 shipped without advisories. No PrimeNG advisories today.