Qdrant published a 9.8 yesterday: in distributed mode, its internal cluster port has accepted requests with no authentication by default. 1.20.0 closes the hole only on clusters that have an API key, and the official Helm chart runs cluster mode without one. Also today: Goose's terminal hook sends shell history to the model provider and no release stops it yet, and Angular's webpack builder still pins a webpack-dev-server without the fixes disclosed yesterday.

A scanner that reads GitHub's database flags DOMPurify, now as a critical. It won't flag Qdrant, Goose or either webpack-dev-server record, and PowerShell has no package record to flag.

Worth your morning

Qdrant: a cluster port that never asked for a key. In GHSA-frc7-44gm-99qq (9.8), published at 14:29 UTC yesterday, a host that can reach a node's internal port, 6335, needs neither an API key nor cluster membership to use it. From there it can add a peer of its choosing, which then receives replicated shards and with them the stored data. It can change cluster state, from collections to shard placement and peer topology, and it can exhaust a node's memory with oversized messages. Single-node deployments don't open the internal port. 1.20.0 shipped fifteen minutes before the advisory.

The fix is a new default, and it needs a key to do anything:

• From 1.20.0, service.enforce_internal_auth is on by default; config/config.yaml at the tag lists it as an opt-out, where 1.19.2 listed it as an opt-in. With it on, the internal API accepts only api_key and alt_api_key.
• A distributed deployment with no API key stays unauthenticated on the internal port after the upgrade. Enforcement is on by default; with no key configured, there is nothing to enforce. Since 1.19.2 such a node logs a warning at startup.
• The official Helm chart (qdrant-1.20.0, also released yesterday) sets cluster.enabled: true, exposes 6335 on its ClusterIP service next to 6333 and 6334, and leaves apiKey unset. Unless a NetworkPolicy says otherwise, any pod that can reach the Qdrant service can reach the internal port.
• 1.20.0 adds no size limit on internal messages. With enforcement on, sending one takes the admin key.

Set the same api_key on every peer, then upgrade. A rolling upgrade works, because 1.19 peers already attach the key to internal requests. Until then, Qdrant's workarounds are to restrict 6335 to cluster members with a firewall, security group or NetworkPolicy, and on 1.18.0 or later to set enforce_internal_auth: true with a key on every peer, restarting one at a time. Enable cluster.p2p.enable_tls so the key doesn't cross the network in plain text. The project's own test is a good one: if your application tier can reach 6333, check that it can't reach 6335. This follows GHSA-3gph from October 6, where the same internal API accepted read-only keys and JWTs once enforcement was on. Neither record is in GitHub's database, and Qdrant ships as an image and a binary, so no package scanner will raise it.

Goose: the terminal hook sends your shell history to the model. In Red Hat's CVE-2026-111079 (7.4, draft score), published yesterday, Goose's terminal integration captures the commands typed in a shell and sends them unredacted to the configured LLM provider with each question. Tokens, passwords and secret-bearing environment variables typed at that prompt go along. The integration only runs in shells whose profile loads goose term init. The project merged a fix to main on October 21 in PR 13051. History becomes opt-in behind a flag named --dangerous-include-history, and the docs gain a warning. No release carries it. 1.55.0 (October 16) is the newest, and the v2 release-candidate tags date from April. Until a release ships, take the goose term init line out of shell profiles, or keep secrets out of shells that load it. If you typed credentials in such a shell, treat them as shared with your model provider and rotate them. Red Hat lists its RHEL 9 and RHEL 10 goose packages as affected. The repository has moved from block/goose to aaif-goose/goose, and its only GitHub advisory, a July high in goose review, is fixed from 1.44.0.

webpack-dev-server: fixed on October 18, still pinned out of Angular's webpack builder. Two advisories went up at 00:36 UTC yesterday, both fixed in 5.2.7 and 6.1.0, which reached npm on October 18. In GHSA-cfqc-fj3v-j925 (8.2), a dev server whose devServer.proxy entry sets ws: true forwards WebSocket upgrades to the proxied backend without checking Host or Origin. A web page the developer visits can then read from and write to that backend, even when the dev server listens only on loopback. In GHSA-wqhc-fvfg-56q6 (5.3), a network peer can make the open-editor endpoint return a full exception stack trace. webpack-dev-server gets 8.9 million downloads a week. Neither record is in GitHub's database.

On the Angular side, @angular-devkit/build-angular pins the dev server to an exact version. Yesterday's 22.2.4, 21.2.28 and 20.3.41 pin 6.0.0, 5.2.6 and 5.2.6, so refreshing the lockfile doesn't reach the fix. The CLI's main branch moved to 6.1.0 at 14:55 UTC yesterday, after 22.2.4 had shipped, and no release carries it yet. Only projects served through the webpack browser builder run webpack-dev-server. Projects on the esbuild-based application builder serve through @angular/build and Vite. The 8.2 applies where proxy.conf.json sets "ws": true, the usual setup for proxying a SignalR hub or another WebSocket backend during development. Until Angular releases, remove ws: true where the backend doesn't need it and narrow each proxy context to specific paths. The alternative is an npm overrides entry for 5.2.7 or 6.1.0; test the dev server after adding it.

DOMPurify: rated low by its maintainers, critical by GitHub. DOMPurify published three advisories with 3.4.17 on October 12 and rated all three low. GitHub's reviewed copies, added yesterday afternoon, rate GHSA-cg2g-xh64-v4q7 9.2 and GHSA-mrv2-3pqr-j5jr 7.6 on v4. The 9.2 is a SAFE_FOR_TEMPLATES bypass involving shadow roots, on 3.4.4 to 3.4.16. The 7.6 needs IN_PLACE sanitization with a hook that removes a parent or sibling node. Both options are off by default, so a plain DOMPurify.sanitize(dirty) call is outside them. DOMPurify gets 42 million downloads a week and is a common way for chat front ends to sanitize rendered model output, so expect npm audit to report the critical in a lot of lockfiles today. 3.4.17 fixes all three and every earlier DOMPurify record. Most consumers' ranges reach it: Mermaid declares ^3.4.12 and Open WebUI ^3.2.6. Monaco is the exception. monaco-editor 0.57.0 (September 24, 5.6 million a week) pins dompurify at exactly 3.4.15, so apps that embed Monaco need an overrides entry until Monaco releases.

PowerShell 7.6: the fix is 7.6.8, not 7.6.7. Microsoft revised CVE-2026-96251 (8.8, remote code execution) and CVE-2026-96303 (6.5, security feature bypass) yesterday to correct the fixed build. For the 7.6 line it is now 7.6.8, released at 17:06 UTC yesterday. 7.4.21 and 7.5.12 are unchanged. This digest named 7.6.7 on October 14, from Microsoft's table at the time. Microsoft calls the revision informational, but the build it corrected is the one you install. Neither CVE is publicly disclosed or exploited. The 7.6.8 notes list one change, the removal of PowerShell's update-notification feature, so the startup notice about new versions stops appearing. Upgrade 7.6 hosts again, including any that took 7.6.7 last week.

Also on the AI stack.

• rmcp 3.7.0 (yesterday): in GHSA-5p52 (medium), the official Rust MCP SDK's OAuth discovery client checked host strings rather than resolved addresses. A malicious MCP or authorization server could steer discovery, token and registration requests to internal addresses. It is an incomplete fix of an earlier advisory, and 2.0.0 to 3.6.0 are affected. 3.7.0 checks every resolved address, but only in the HTTP client that AuthorizationManager::new builds; a client you pass in still needs its own address policy.
• ToolHive 0.56.0 (yesterday): GHSA-7h6f (4.2) let a DNS-rebinding web page list and call every tool on a local vMCP with the backend credentials vMCP holds; incoming authentication blocks it on older versions. GHSA-cmf3 (6.5) needs CIMD, which is off by default.
• LanceDB 0.40.0 (October 7; Python, npm and Rust): in GHSA-jw4x (4.7), table names and namespace paths went into LanceDB Cloud REST URLs unencoded. An app that opens tables by names taken from user or model input could reach another table or another tenant's namespace. LanceDB Cloud only.
• GitLab MCP server 2.3.7 (this morning): in GHSA-5xhm (5.4), the project allowlist was skipped for API paths with no parseable project ID, on 2.2.5 to 2.3.6.
• virtualenv 21.14.13 (yesterday): GHSA-cx6f is a regression in 21.14.9, the floor this digest gave on October 20. With promptvars off at activation, the bash activator leaves a --prompt value unescaped, and it runs as a command once prompt expansion is turned on. The project rates the class high. The floor is now 21.14.13.
• AstronRPA 1.1.7 (yesterday) includes PR 887, which validates Bearer tokens in the gateway and closes CVE-2026-108548. The reporter's fix PRs for the other three October CVEs are still open.
• Langflow 1.13.0 (yesterday) has one fix(security), a size bound on URL component responses, and no advisory.
• eMudhra follow-through. Weaviate 1.40.2, 1.39.13 and 1.38.22 (yesterday) carry a security patch for the eight eMudhra intermediates. OpenClaw 2026.10.6 now requires Node.js 24.22.1 or 26.12.1. Trigger.dev 4.7.7 runs deployed tasks and self-hosted images on the patched Node releases, and AutoGPT's platform beta 0.9.0 ships Node 24.22.1 in its Docker images.

On the Venicecom stack. webpack-dev-server and PowerShell are in the table. Angular 21.2.28 and 20.3.41, released yesterday, move @angular/build to Vite 7.3.7. That fixes the two Vite records from October 21 that reach the 7.x line; the third doesn't affect 7.x. 22.2.4 still pins Vite 8.3.0, which all three affect; the fix on that line is 8.3.3. Microsoft published four cloud-service CVEs yesterday: VM Inspector for Azure Virtual Machines (10.0), Azure Kubernetes Configuration Service (10.0), Azure Pipelines (9.1) and Azure AI Foundry (7.7, server-side request forgery). Microsoft says all four are fully mitigated and customers have nothing to do. CVE-2026-70197 is still at revision 2.0, and OpenAPI.NET's GHSA-m2pf still isn't in GitHub's database. No PrimeNG advisories today.

Paperwork your scanner may raise. Yesterday afternoon GitHub's database added the three Next.js records from October 15: GHSA-2464 (9.5, Image Optimization with SVG), GHSA-673q (9.5, use cache) and GHSA-p3m5 (8.2, Server Actions CPU exhaustion). npm audit now flags 15.5.27, 16.4.0 and older, and the fixes are still 15.5.28 and 16.4.1. It added 11 more Pillow records, including the 9.8 GHSA-v9pv, so 39 of 41 are there. The FlashPix critical and the unfixed GHSA-654x are the two missing. Storybook's GHSA-px85 (8.7), PyJWT's GHSA-pxh4 (7.4, fixed in 2.14.0, floor still 2.15.0), nbconvert, Jupyter Server, GitPython and three pypdf records arrived too, all covered here before. LiteLLM's GHSA-7hp6 (9.9) now has CVE-2026-114612 and still no GitHub database record. NVD's text starts the range at 1.87.0 and the advisory at 1.91.0; the fixed versions are unchanged. virtualenv's October 17 batch got CVEs. Agent Zero's CVE-2026-97635 (8.1, with a CISA advisory) is a Web UI cross-site scripting bug fixed in v1.15 in May; current releases are 2.x.

Standing items. MLflow PR 26842 is still open, so CVE-2026-53995 has no fix. SGLang's four fix PRs (45017, 42098, 44314 and 44653) remain unmerged, and 0.5.22 is still the newest. CrewAI's ZDI zero-day, covered yesterday, still has no fix, and 1.15.28 is current. Kubeflow Model Registry 0.3.18, released yesterday, doesn't touch the files CVE-2026-110220 cites, so that CVE still has no fix. DB-GPT is still on 0.8.2, with issue 3167 open. Xoscar 0.12.1 keeps XOSCAR_AUTH_KEY opt-in, and Xinference 4.0.1 still lacks the Windows path fix. picomatch PR 194 is open. Gradio 6.30.0 and Open WebUI still cap Pillow below 13. MCP Inspector's nine records and the MCP Java SDK's three still aren't in GitHub's database. Unchanged: Archon 0.12.1, Chroma 1.5.9, Portkey AI Gateway 1.15.2, BotSharp, Unla 0.10.0, Plano 0.4.37, the MCP Kotlin SDK 0.15.0, Vearch 3.5.9, openapi-typescript-codegen 0.31.0, cc-connect, Mooncake 0.3.13.post1, pandas-ai 3.0.0, LightLLM v1.2.0, GPT-SoVITS, Langchain-Chatchat 0.3.1.3, BentoML 1.4.39, BrowserSkill (PR 363 unmerged), hyper-mcp (nightlies only) and mcp-remote 0.15.2. LiteLLM 1.106.2 and n8n 2.44.6 / 1.123.86 shipped without advisories.