Microsoft shipped an out-of-band .NET update yesterday: 8.0.33, 9.0.22 and 10.0.14 fix a Brotli decoder flaw, finish two fixes the October 13 release left incomplete, and correct file ownership in Linux tarballs. The decoder flaw is upstream Brotli's, so the Python packages and Envoy need patching too. On the AI stack, Xinference 4.1.0 fixes a critical code-execution flaw, and GitHub's database now says MLflow 3.17.2 fixes a path traversal that it doesn't.

A scanner that reads GitHub's database now flags Python's Brotli below 1.2.1, as a critical. For .NET it still treats the October 13 builds as fixed, and it clears MLflow 3.17.2 and Pillow 13.0.0 of flaws both still have. Xinference, the MCP servers and Aider won't show up: their records aren't in the database, and GitHub's reviewed feed has published nothing since 22:27 UTC on Friday.

Worth your morning

.NET: the October fixes, finished on a Sunday. Microsoft released .NET 8.0.33, 9.0.22 and 10.0.14 yesterday, with SDKs 8.0.133 / 8.0.427, 9.0.123 / 9.0.320 and 10.0.114 / 10.0.403, plus .NET 11 RC3. .NET Framework isn't affected. Four CVEs:

• CVE-2026-111497 (8.1; Microsoft rates it critical and lists it as publicly disclosed) is the Brotli decoder flaw below, in .NET's own copy. ASP.NET Core and HttpClient don't decompress Brotli by default. An app is exposed if it enabled request decompression with br, set AutomaticDecompression to include Brotli or All, or passes untrusted data to BrotliStream or BrotliDecoder. Until you patch, remove br from a decompression setup you already have, or drop Brotli from the flags. Microsoft warns against adding decompression to an app that doesn't already use it.
• CVE-2026-70197 (8.1, Windows) is the socket out-of-bounds write that, as reported here on October 20, Microsoft said the October 13 release hadn't fixed. These releases carry the corrected fix.
• CVE-2026-102870 (8.8), code execution on a developer's machine through the Blazor WebAssembly debugger, wasn't fully fixed on October 13 either. Update the Microsoft.AspNetCore.Components.WebAssembly.Server and .DevServer package references to 10.0.14. Updating the runtime alone doesn't replace them.
• CVE-2026-114148 (7.8, Linux) is new. Microsoft's ASP.NET Core 8 and 9 runtime and targeting-pack tarballs, and every source-built tarball, install files with the wrong owner, which lets a local user elevate privileges. Replace those installs cleanly, as the advisory describes, rather than extracting the new version over the old one.

Don't let a scanner decide when you're done. GitHub's database records for CVE-2026-70197 and CVE-2026-102870 still name 8.0.32, 9.0.21 and 10.0.13 as fixed, so NuGet's audit and Dependabot clear the October 13 packages. The corrected ranges are only on the repository advisories, and neither new CVE is in the database. Microsoft's own table for CVE-2026-70197 still lists the October 13 builds on its "runtime installed on Windows" rows. Go by the version numbers above. Container images are tagged 8.0.33, 9.0.22 and 10.0.14. PowerShell 7.4.22, 7.5.13 and 7.6.9, released yesterday afternoon, move to the new SDKs, and Microsoft lists them as PowerShell's Brotli fix. On 7.6 that replaces the 7.6.8 from Friday's table, so upgrade PowerShell hosts again, on all three lines this time.

Brotli: one decoder, many copies. Google's CVE-2026-111497 (9.2 on v4) is an out-of-bounds write in the Brotli decoder in versions 1.0.3 through 1.2.0. A crafted compressed stream can corrupt decoder memory, leak it, crash the process or possibly run code. Brotli released 1.2.1, 1.1.1 and 1.0.10 on Wednesday evening. Node.js fixed its copy the same day, as covered on October 22, and .NET followed yesterday. The other copies:

• Python. Brotli 1.2.1 and brotlicffi 1.2.1.0 reached PyPI on Thursday, and GitHub's record, GHSA-9v8h-qqgm-4m35 (critical), flags every release from 1.0.3. urllib3 (and so requests), aiohttp and httpx decompress br responses automatically whenever one of these packages is installed. An agent's fetch tool that follows a link to an attacker's server therefore hands the attacker's stream straight to the decoder. Gradio and crawl4ai require brotli>=1.1.0: a fresh install gets 1.2.1, an existing lockfile doesn't. Open WebUI 0.12.4 pins 1.2.1. GitHub's record carries no CVE ID, so a tool that matches on CVE-2026-111497 won't connect it to the package.
• Envoy. Envoy's advisory GHSA-3wvj-j6qm-62mr (critical), published on Friday, puts the fix in releases already out: 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. Only deployments with the Brotli decompressor filter configured are exposed. The Plano gateway moved to a fixed Envoy in 0.4.38 on Saturday.
• Linux packages. Red Hat lists the brotli package on RHEL 8, 9 and 10 as affected, with no fixed build yet.

Xinference: a critical with no score, fixed yesterday. Xinference 4.1.0 reached PyPI at 04:35 UTC yesterday, and four advisories followed from 09:42.

• In GHSA-2gq8-2q98-6w29 (critical, unscored), through 4.0.1, a caller who can launch models can point the CosyVoice loader at a model source or local path whose configuration runs code on the worker. The advisory calls it unauthenticated. 4.1.0 refuses custom CosyVoice sources and explicit local paths unless the worker sets XINFERENCE_TRUST_REMOTE_CODE=1, and built-in models load as before. Setting the variable sandboxes nothing, so don't set it to make an untrusted model work.
• In GHSA-v43j-w7xm-2vwh (8.1), from 3.0.0, anyone who reaches the API of a server whose first administrator hasn't been created yet can create that administrator. From 4.1.0 it takes a setup token that the API server prints in its startup log. Upgrading doesn't remove an administrator someone else already created, so if a server sat uninitialized on a reachable network, review its accounts and API keys. Persist the authentication database across container rebuilds, or a rebuilt container reopens setup.
• The two mediums are unauthenticated reads of model configuration files outside the model roots through auto-registration (5.3, from 0.13.1) and worker addresses leaking in chat-completion errors (4.3).

4.1.0 also carries the Windows path fix for CVE-2026-112051, which this digest has listed as unreleased since October 20. It adds Xoscar's actor authentication, still opt-in through XOSCAR_AUTH_KEY.

MCP reference servers: the fetch guard's first bypasses. The MCP project released v2.1.0 of its reference servers just after midnight UTC yesterday, with eight advisories across three servers.

• fetch. The private-address guard that shipped in 2026.10.10, covered on October 11, checked one form of an internationalized host name and connected to another. Any domain owner could reach loopback, private and cloud-metadata addresses through it again (GHSA-v38p-wf49-hx2j, 6.3 on v4). The guard also treated NAT64 addresses as public (3.1), and robots.txt wasn't checked again after a redirect (3.1). 2026.10.24 fixes all three.
• filesystem. Four gaps in the path checks let tool calls read, write or list files outside the allowed directories (2.2 to 5.3). The worst, 5.3, needs a case-insensitive volume, the default on macOS and Windows, and is a regression in 2026.8.31; the 2.2 needs a local user. The realistic trigger is prompt injection in content the model reads, steering its tool arguments.
• everything. Its HTTP and SSE transports accepted cross-origin requests, so a web page visited while the server ran could call get-env and read the server's environment variables (GHSA-mvf5-2qqv-rg3c, 6.5). The default stdio transport isn't affected.

filesystem and everything are fixed in 2.0.1. Both packages went back to semantic versioning this month, and npm marks every date-based release as deprecated. A ^2026.8.31 range will never reach 2.0.1, so install @latest or pin 2.0.1.

MLflow: GitHub's database calls 3.17.2 fixed, and it isn't. GitHub's record for CVE-2026-53995 (8.2; 8.8 on v4), the FileStore trace-ID path traversal this digest has carried as unfixed since October 20, was last updated at 21:34 UTC on Friday and now says 3.17.2 fixes it. 3.17.2 went to PyPI at 02:08 UTC on October 21. The fix the record cites, PR 26979, merged to master at 07:34 UTC on October 22, and file_store.py at the v3.17.2 tag has none of its trace-ID validation. The release the record names shipped a day before the fix it cites. No release carries the fix yet, and the earlier fix PR, 26842, is still open. Scanners that read GitHub's database, Dependabot among them, now clear 3.17.2. Only tracking servers on a FileStore are exposed: mlflow server defaults to a SQLite store and uses ./mlruns only when it already holds data. Keep --backend-store-uri on a database until a release ships.

Aider: a repository can carry its own commands. VulnCheck's CVE-2026-115726 (7.8; 8.5 on v4), published on Friday: Aider loads .aider.conf.yml from the repository it runs in without asking, and that file's notifications-command and editor settings run through a shell. A cloned repository can run commands as the developer once aider replies or /editor is used. Every release through 0.86.2, the newest (February 12), is affected. Issue 5885, opened on October 20, has no reply, and the repository's last commit is from May 22. Before running aider in a repository you didn't write, look for .aider.conf.yml and read what it sets.

Also on the AI stack.

• Open WebUI 0.12.4 (yesterday): the release notes say it contains security fixes that aren't listed and that advisories will follow, and they recommend updating every deployment as soon as possible. It also pins Pillow 13.0.0, which lifts the Pillow cap this digest has listed since October 21.
• Hydra 1.3.8 (yesterday): in GHSA-wf6j (7.8), the legacy instantiate() blocklist let configuration reach PyYAML's unsafe loaders on 1.3.6 and 1.3.7, the releases that fixed the earlier bypasses. It's the fifth such advisory since July. Exposure needs untrusted configuration passed to instantiate() or call(), such as a downloaded model that ships its own config. NeMo 3.0.0 still pins hydra-core<=1.3.2, below every fix.
• Docling 2.142.1 (Friday, after Friday's digest): eleven advisories. Nine are memory or CPU exhaustion from crafted DOCX, XLSX, EPUB, LaTeX, AsciiDoc, archive or image input (up to 6.5). The file read and write through Tectonic TikZ rendering (6.8) and the XBRL taxonomy fetch (3.1) need options that are off by default.
• Hugging Face Datasets CVE-2026-57845 (8.8; 8.7 on v4, VulnCheck): load_dataset("pandas", data_files=…) unpickles the files it's given, so a crafted file runs code. It covers every release through 5.1.0, the newest, and PR 8879 is open. The deprecated pandas builder runs only when called by name; Datasets doesn't pick it for .pkl files on its own. Don't load pickle files you didn't create.
• Kubeflow Model Registry 0.3.18 (Thursday) fixes two advisories published on Friday: an unauthenticated file read through the catalog preview's yamlCatalogPath (rated low, from 0.3.4) and a catalog-mounted git credential sent to a host the caller picks from skill-catalog preview (medium, 0.3.16 and 0.3.17). CVE-2026-110220 still has no fix.
• GitLab MCP server 2.3.8 and 2.3.10 (weekend): download capability URLs skipped the per-session project allowlist (6.5, 2.1.58 to 2.3.7), and REMOTE_AUTHORIZATION mode didn't bind sessions to their owner (medium, through 2.3.9). 2.3.11 is current.
• Google ADK for Java 1.13.0 (Wednesday): in CVE-2026-107858 (7.2 on v4), the adk web development server accepted WebSocket and REST requests from any origin, so a web page the developer visited could drive a running agent and read its data.
• LocalAI 4.12.1 (Friday) is a security-only release. It checks every redirect hop of a user-supplied media URL, treats 100.64.0.0/10 and 0.0.0.0/8 as private, and connects to the address it checked. There's no advisory yet.

On the Venicecom stack. .NET and PowerShell are above. @azure/msal-node 7.1.0 (October 13) fixes CVE-2026-109461 (7.5 by GitHub, 5.9 by Microsoft): the authorization-code flow could send request parameters to an attacker-controlled endpoint. It went past this digest when Microsoft published it on October 16, and GitHub's database added it on Friday. Until you upgrade, pass only the authorization code to acquireTokenByCode. body-parser 2.4.0 and 1.20.9 (Thursday) fix a crash any single request can cause under default options (7.5): a compressed body followed by trailing bytes takes the process down, before routing and without authentication. Express 4.22.3 and 5.3.0 accept the fixed versions, so a lockfile refresh is enough; set inflate: false where you don't accept compressed bodies. MCP servers built on Express sit on it too. Angular hasn't released since Thursday, so @angular-devkit/build-angular still pins webpack-dev-server 6.0.0 / 5.2.6, and 22.2.4 still pins Vite 8.3.0. No PrimeNG advisories today.

Paperwork your scanner may raise. GitHub's database added a batch on Friday evening before the weekend. Pillow's FlashPix critical GHSA-5x8w arrived, fixed in 13.0.0, and so did GHSA-654x, so all 41 of Pillow's October records are in now. GitHub's copy of GHSA-654x says 13.0.0 fixes it. Pillow's own advisory still counts 13.0.0 as affected, and no newer release exists, so on 13.0.0 keep PILLOW_ALIGNMENT unset in applications that export images to Arrow. Three more undici records, four fast-uri, two FastMCP, nine virtualenv and three pypdf records arrived too, all covered here before. VulnCheck assigned ten CVEs, CVE-2026-116172 to CVE-2026-116181, to the vLLM advisories covered on October 10, all fixed by 0.31.0. CVE-2026-116175 is a second CVE for the audio-duration bug that already has CVE-2026-57173. Fixed long ago: mem0's Databricks SQL injection (9.2 on v4, fixed in 1.0.8; 2.2.1 is current), Strands Agents' A2A session leak (8.1, fixed in June) and Mistune's include directive (fixed in 3.3.0). Zod's GHSA-mrhx (7.5; 8.2 on v4), memory exhaustion when validating oversized constrained collections, now names 4.6.6 (October 11) as the fix. Every 3.x release is in range and none is fixed, and the MCP TypeScript SDK accepts zod 3.25 or 4, so check which one your lockfile resolved. filelock published twenty advisories on October 17 that this digest missed. All of them need another local user on the same machine racing symlinks or lock files, and 4.2.1 fixes them all; huggingface_hub, PyTorch and vLLM install filelock.

Standing items. Goose 1.56.0 (Friday) carries PR 13051, so the terminal hook no longer sends shell history unless --dangerous-include-history is set. Upgrade, and still treat anything already typed in a hooked shell as shared. RAGFlow 0.27.3 (Friday) carries the agent authorization fix from October 5, and its Docker .env still sets REGISTER_ENABLED=1. SGLang's PR 42098 was closed unmerged on Sunday by a bot that limits idle pull requests per author; 45017, 44314 and 44653 remain open, and 0.5.22 is still the newest. CrewAI 1.15.29 and 1.15.30 don't touch load_agent_from_repository, so the ZDI zero-day still has no fix. Plano 0.4.38 updated Envoy for Brotli and left its admin ports as they were. BentoML 1.4.40 requires the fixed certifi, and its notes don't mention the Dockerfile-template CVE. Gradio 6.30.0 still caps Pillow below 13. Qdrant has released nothing since 1.20.0, and Monaco nothing since 0.57.0. Unchanged: DB-GPT 0.8.2 with issue 3167 open, picomatch PR 194, Archon 0.12.1, Chroma 1.5.9, Portkey AI Gateway 1.15.2, BotSharp, Unla 0.10.0, the MCP Kotlin SDK 0.15.0, Vearch 3.5.9, openapi-typescript-codegen 0.31.0, cc-connect, Mooncake 0.3.13.post1, pandas-ai 3.0.0, LightLLM v1.2.0, GPT-SoVITS, Langchain-Chatchat 0.3.1.3, BrowserSkill (PR 363 unmerged), AstronRPA 1.1.7 and mcp-remote 0.15.2. LiteLLM 1.106.4 and n8n 2.44.7 / 1.123.88 shipped without advisories.