n8n published twelve repository advisories at 08:47 UTC yesterday, about 80 minutes after its last fixed release: two let a user who can edit workflows run code on the host (7.7), and a third reaches the main process through three deprecated nodes (8.7). On the Venicecom stack, Angular's build tool fixed a code-injection flaw in the server manifests it generates, the same morning. No scanner will raise any of it.

GitHub's reviewed database returns 404 for every n8n, Milvus, Angular and KServe advisory above, and the three CVEs (KServe, Red Hat's gateway, Telerik) sit in its unreviewed feed with no package attached. What the reviewed feed did publish, 92 records in a burst from 19:49 to 22:43 UTC yesterday, is mostly fixes that are weeks old; see Paperwork.

Worth your morning

n8n: twelve advisories, and your last upgrade may sit inside them. The fixed releases reached npm between 07:18 and 07:25 UTC yesterday; the advisories followed at 08:47. npm's latest is 2.45.5. The advisories also name 3.0.1, which exists on GitHub as a pre-release (08:06 UTC) and not on npm. 2.44.7 and 1.123.88, released on October 26 without advisories, are inside every range.

• GHSA-9p7v (8.7): the Function, Function Item and LangChain Code nodes ran user code in the main process, outside the task-runner isolation the Code node has, so a user who can edit workflows could run code there. 2.42.6, 2.43.3 and 2.44.0 deprecate those nodes and block them by default: saving a workflow that adds or changes one is rejected, and saved workflows keep running. Setting N8N_DEPRECATED_NODES_BLOCK=false restores the vulnerable behaviour, so leave it alone.
• GHSA-gx3v (7.7): a user who can create or change workflows could get out of the isolation around expression evaluation and run code on the host. The advisory's interim measures: remove global:member from users you don't fully trust, audit active workflows for expressions that reference unexpected JavaScript properties, and use NODES_EXCLUDE.
• GHSA-f2cw (7.7): the GraphicsMagick bundled in the official Docker image had known flaws, so the Edit Image node processing untrusted images could lead to code execution. If you can't upgrade, deactivate workflows that feed an unauthenticated Webhook node into Edit Image.
• GHSA-pwj5 (6.3): a Chat Trigger in embedded mode with n8n User Auth skipped the check on one request type, so an unauthenticated caller could read a named session's history or start the workflow.
• Eight more, 4.8 to 6.3: the NocoDB node sent its API token to a host the caller chose; credential-using nodes forwarded authentication headers across origins on redirect; the Asana Trigger's webhook secret could be reset without authentication; the Browser Use upload tool could read files from the server; the MongoDB node's update could touch unintended documents; MCP OAuth client registration allowed an open redirect; the OracleDB vector store node had SQL injection through a metadata filter key; and an unauthenticated callback could hijack an OAuth account in the end-user credential connect flow. Five of the eight exist only on 2.x.

Angular: the flaw is in the build, so the fix is a rebuild. GHSA-w34w (7.7 on v4) covers apps built with @angular/build:application that prerender and also serve with SSR (outputMode: "server"). Route parameters returned by getPrerenderParams() were written into the generated server manifest without escaping, so if they come from an external source such as a CMS or API, a crafted value could run code in the SSR server process when it loads that manifest. The companion GHSA-jp2q (2.1) is the same missing escaping in prerendered redirect pages, which yields script injection in the browser. 20.3.42, 21.2.29 and 22.2.5 reached npm between 09:50 and 10:02 UTC yesterday; the advisories followed at 10:11. Upgrading @angular/build changes nothing for a build already deployed: rebuild and redeploy. Angular 19 and older won't be patched; there the control is not feeding untrusted data to getPrerenderParams(). @angular/build has 5.4 million downloads a week.

Milvus: two highs where authentication or RBAC was skipped. Milvus published six advisories at 11:01–11:03 UTC yesterday; the fixes for both highs are already out.

• GHSA-hr46 (high, unscored): the external proxy's gRPC server applied no authentication to two streaming RPCs, so a caller who could reach it needed no credentials even with authorization enabled. One of them could return retained write-ahead-log messages across collection and database boundaries, which may include inserted vector and scalar data; the other accepted replication input. Fixed in 2.6.23 (August 28) and 3.0.1.
• GHSA-gg6q (high, unscored): the legacy /api/v1/* REST routes on the management port, 9091, authenticated callers but skipped RBAC, so an ordinary account could create credentials or drop collections it had no grant for. Fixed in 2.6.25 (September 29); 3.0.3 (October 14) removes the routes.
• Four mediums: missing authorization on statistics and topology calls, collection-visibility bypasses through DescribeCollection and ID lookups, import-job status calls that show another database's metadata (4.3 each), and missing authorization on client-telemetry administration (unscored, 3.0.0 to 3.0.3 only). The three that reach 2.6 have no fix on that line, so a 2.6 deployment stays exposed to them; 3.0.4 fixes all four. An earlier critical, from February, was also about unauthenticated access on 9091, so keep it off reachable interfaces.

KServe and Red Hat's gateway: two cluster-side items with nothing to install. KServe's repository advisory, GHSA-9qqf (7.7), went up on October 7; Red Hat filed CVE-2026-13451 for it yesterday evening, and this digest hadn't carried it. Anyone with create or update rights on an InferenceService in a namespace can set a storageUri that makes the storage-initializer container send HTTP or HTTPS requests from inside the cluster, which can reach internal services or the node's cloud credentials. The fix, commit cf14d1fa2, merged on October 7 and is in master; v0.21.0 (September 25) predates it and no later release exists. Until one does, restrict who holds those rights and filter egress from model-serving namespaces.

Red Hat's CVE-2026-117574 (9.1) is in ai-gateway-payload-processing: an authenticated caller who names another tenant's model in a request gets that tenant's API keys fetched from the shared store and injected into the call, so they can spend that tenant's LLM quota. The record names no version and no fix. The Open Data Hub repository of that name has no release or advisory, and its recent commit titles don't mention one.

Also on the AI stack.

• Telerik Telerik.Documents.AI.AgentTools.Conversion 2026.3.1027 (October 27) is in the table: the Convert and Merge AI agent tools let a low-privilege caller who supplies tool arguments read files outside the configured output directory and overwrite writable ones (CVE-2026-118038). The vendor's page lists no workaround.
• Strands Agents Tools 0.8.6 (August 7; 0.8.10 is current): in GHSA-qjx4 (6.5, CVE-2026-115415, published last evening), a crafted prompt could switch off the environment tool's secret masking and return the agent host's environment variables, cloud credentials and API keys included.
• AutoGPT 0.10.0 (October 27) fixes GHSA-xfwx (7.1, published 04:00 UTC today): on a deployment that offers a platform Anthropic credential to customers who run graphs, an error path exposed the raw credential, and picking an own E2B credential let platform-funded work skip the credit ledger. Three mediums published in the last day, two ReDoS (6.5) and a public chat share that leaked secrets under camelCase keys (5.9), were fixed in 0.8.3.
• MCP servers v2.2.0 (yesterday, 20:57 UTC): mcp-server-git 2026.10.28 fixes GHSA-w766 (5.3), where a nested gitdir file got around the --repository confinement.
• mcp-sanitizer 1.4.0 fixes two highs (GHSA-7w82, 7.5; GHSA-4mfg, 8.2). A library whose job is to reject unsafe paths and URLs had /home/ and /Users/ on its path allowlist, and let loopback through whenever a port was named. It has about 640 downloads a week.
• chrome-devtools-mcp 1.5.0: CVE-2026-106484 (4.4, Chrome rates it medium), a local read and write through a malicious file on Linux.
• pypdf 6.21.4 (yesterday) fixes three more mediums, two infinite loops and heavy memory use on a crafted page tree.

On the Venicecom stack. @angular/build and Telerik are in the table. The three Angular releases also move the Vite pin past the October 21 dev-server records: 22.2.5 pins Vite 8.3.5 (the fix on that line is 8.3.3), and 21.2.29 and 20.3.42 pin 7.3.7. The webpack builder is unchanged: @angular-devkit/build-angular 22.2.5 still pins webpack-dev-server 6.0.0, and 21.2.29 and 20.3.42 pin 5.2.6, below the 6.1.0 and 5.2.7 fixes. MSRC shows no .NET or Azure revisions since Tuesday's acknowledgement edits, and PrimeNG has no advisories. .NET 8 and 9 reach end of support on November 10, twelve days out.

Not on the tracked list, but it holds Azure tokens: Grafana's CVE-2026-88967 (7.7) lets a user with query access to an Azure Monitor data source make the server send requests to an endpoint of their choosing and disclose that data source's Azure access token. Fixed in 12.4.14, 13.0.12, 13.1.9 and 13.2.5 (October 27). A separate 8.9 on v4, CVE-2026-103506, is an SSO-settings authorization bypass that applies only to 13.2 with the experimental kubernetesSsoSettingsApi toggle on; 13.2.5 fixes it.

Paperwork your scanner may raise. The reviewed feed's burst last evening covered, among others: vLLM's eight (0.32.0, October 21; one is a 7.5 pickle path, one an 8.1 through Ghostscript), ONNX's four (1.22.0), filelock's twelve (4.2.1), Mem0's GHSA-5324, and three LangGraph records: langgraph-api below 0.15.0 (8.6 on v4, September 29), langgraph-sdk below 0.4.6 (4.3, October 8) and langgraph-cli through 0.4.31, where langgraph deploy --verbose printed the registry push token (5.4, 0.4.32 since September 23, October 20). Tornado 6.6 (October 21) now has three records for slow header and chunked-body parsing (5.3 twice) and an open redirect. MySqlConnector below 2.6.1 (6.9 on v4) could disclose the account password to a man in the middle in its zero-configuration TLS mode.

Outside the beat, with fixes weeks old: Highcharts' fifteen (2.8 million downloads a week; up to 8.6 on v4, mostly script injection through chart options and labels that carry untrusted text; Highcharts 11.4.9, 12.6.2 and 13.1.1 shipped in September, and the Dashboards and Grid packages have their own fixed versions in the records), Wasmtime's CVE-2026-115893 (9.9, aarch64 only, 36.0.19, 48.0.7 and 49.0.4), the Rust zip crate's CVE-2026-115905 (10.0 on v4, 9.0.5), ten records for Go's Echo framework (4.7 to 7.5; the records name the fixed versions), and happy-dom's SSRF (8.6, 21.0.0).

Two sets of identifiers, no new flaws. VulnCheck filed fifteen CVEs (CVE-2026-118640 to CVE-2026-118649 and CVE-2026-118675 to CVE-2026-118679) for n8n flaws fixed by 1.123.85, 2.43.5 and 2.44.1 or earlier, the release covered on October 15. GitHub added CVE IDs to eighteen Open WebUI advisories published on September 27 and 28 (CVE-2026-109283 to CVE-2026-109300, plus CVE-2026-109572), all fixed in 0.11.4; 0.12.4 is current.

Standing items. MLflow has released nothing since 3.17.2 (October 21), so the fix for CVE-2026-53995 is still on master only. Open WebUI has released nothing since 0.12.4 (October 25) and published none of the advisories its notes promised. CrewAI 1.15.33 reached PyPI last night with no GitHub release yet, and nothing names a fix for ZDI-26-706. LiteLLM 1.106.6 and 1.105.7 (late last night) are current on the lines fixed on October 27. Unchanged: vLLM 0.32.0, SGLang 0.5.22 and Chroma 1.5.9 are still the newest releases.