Langflow has a new IBM bulletin: two 9.8s that need no account, fixed in 1.13.0, which has been on PyPI since October 22. The 1.12.7 this digest recommended on the 21st is inside the range. LMCache and LanceDB each got a repository advisory for code execution, fixed in 0.5.6 and 0.41.0, Agno's PandasTools has one with no fix, and Open WebUI 0.12.5 is a security release that lists nothing.

A scanner will raise none of these. GitHub's database holds the Langflow CVEs, Agno's, open's and Crawl4AI's CVEs as unreviewed records with no package attached, LMCache's CVE the same way since October 7, and nothing at all for the LMCache, LanceDB, Crawl4AI and Kiota repository advisories. Open WebUI has no advisory.

Worth your morning

Langflow: a new floor, 1.13.0, eight days after its release. IBM's bulletin, dated October 28 and updated the 29th, covers 1.0.0 through 1.12.8 and names 1.13.0 as the fix. CVE-2026-93680 (9.8) is an authentication bypass and CVE-2026-110186 (9.8) is remote code execution. Both vectors require no account, and IBM names no component or precondition for either. CVE-2026-110193 (8.8) lets a low-privileged account make the Agentic Assistant run operating-system commands on the server, and CVE-2026-110192 (6.5) exposes poorly protected credentials to an authenticated user. The bulletin also lists three CVEs in Hono, fixed in Hono 4.13.5.

1.13.0's release notes don't mention any of this; the bulletin is the only place that ties the fixes to it. This digest said on October 21 to take 1.12.7, and 1.12.8 followed the next day, so both are affected. Take 1.13.0 (1.13.1rc1 is a pre-release on PyPI). NVD and GitHub's feed took 33 IBM Langflow CVEs yesterday: 16 from IBM's October 19 bulletin (1.0.0 – 1.12.3, fixed in 1.12.4), 13 from the one covered on October 20 (1.12.5), and these four. Anyone on 1.12.5 or later was already clear of the first two groups.

LMCache: the endpoint that runs Python is the feature. GHSA-7p86 went up at 00:09 UTC today for CVE-2026-107204 (9.8), which GitHub's feed has carried without a package since October 7. In LMCache through 0.5.5, POST /run_script on the administrative HTTP service ran caller-supplied Python inside the server process with no authentication, and the advisory says the restricted builtins are not a boundary. It was reachable whenever the port was. 0.5.6 turns the endpoint off unless LMCACHE_RUN_SCRIPT_API_ENABLED (or the config key or flag) is set, and binds the administrative listeners to 127.0.0.1. It is the same release that fixed the multiprocess 9.8 covered on October 17, so anyone who acted on that one is clear. If you set the opt-in, do it only on a trusted network.

Agno: a tool that lets the model pick the function, and no fix. CVE-2026-119050 (VulnCheck, 9.2 on v4, 8.1 on v3.1): PandasTools takes the pandas function to call from the model, so instructions injected into anything the agent reads can end in code execution on the agent's host or in local files being read. The record says "through 3.1.11". 3.1.12 reached PyPI on October 29 at 14:01 UTC, 16 minutes before NVD published the CVE, and doesn't touch the file: libs/agno/agno/tools/pandas.py has had no commit since April, and issue 8699, a security report, has been open since July 2. The upper bound is where the reporter stopped, not a fix. Remove PandasTools from agents that read untrusted content.

open: one library, and the MCP bridge that can't take the fix. open (219 million downloads a week) passed URLs to PowerShell on Windows and WSL without escaping them before 11.0.0 (CVE-2026-119025, 7.7 on v4). Code that opens a URL a server supplied, such as an MCP server's OAuth authorization endpoint, can therefore be made to run PowerShell on the user's machine. The MCP Inspector advisory fixed in 2.12.0 and covered on October 22 describes the same path. 11.0.0 shipped in November 2025; 11.0.4 is current.

mcp-remote (901,000 downloads a week, a common bridge to remote MCP servers) declares open ^10.1.0 in 0.15.2 and on main, so a lockfile refresh resolves to 10.2.0, inside the range, and its repository shows no change to the pin. On Windows or WSL, connect it only to servers you control until that moves. An npm overrides entry for open is the other route; this digest hasn't tested it against mcp-remote. On the Venicecom side, @angular-devkit/build-angular 22.2.5 and 21.2.29 pin open 11.0.4 and 11.0.0; 20.3.42 pins 10.2.0, but that builder opens the dev server's own address, which an attacker doesn't supply.

Open WebUI 0.12.5 doesn't say what it fixes. It reached PyPI on October 29 at 09:11 UTC, 99 commits after 0.12.4. The notes call for updating "as soon as possible", say the fixes are not in the changelog, and promise advisories after CVE assignment. The repository's newest advisory is still from October 18. The 0.11.1 fixes (August 25) preceded the first of their advisories by four days, so don't wait for these.

Also on the AI stack.

• LanceDB 0.41.0 (October 29, 08:08 UTC; 1.9 million downloads a week): the Python package restored a table's embedding settings from the table's own metadata, and the sentence-transformers embedding defaulted trust_remote_code to True. Querying a .lance table from an untrusted source could therefore run code from a model repository the table named (GHSA-x8v2, high, published 17:06 UTC yesterday). 0.41.0 defaults the flag to False; the October 19 commit behind it is marked as a breaking change and stops trusting embedding settings from table metadata, so retest code that relied on restored embedding functions.
• Crawl4AI 0.9.5 (October 14; 360,000 downloads a week): six repository advisories went up on October 15, and VulnCheck filed five CVEs against them yesterday. The one GitHub rates high, CVE-2026-119120 (7.7 on v4), lets an authenticated client of the Docker API server choose which Hugging Face model it loads, and so what code it runs. The others: a denial of service (8.7 on v4), certificate validation (8.3), a blind SSRF (6.9) and script injection into the crawled page (5.3); the sixth advisory, a ReDoS, has no CVE. The certificate one isn't limited to the Docker server: Chromium always launched with certificate errors ignored, so crawls could be intercepted. Crawl4AI wasn't on this digest's watch list; it is now.
• llama.cpp rpc-server: CVE-2026-119052 (8.7 on v4, 7.5 on v3.1) lets an unauthenticated peer crash it with an oversized message length after the handshake; denial of service only. Builds before b11935 (October 27) are affected, b12000 is current. Ollama 0.40.13 pins b11963 and doesn't include the RPC backend.
• zereight/gitlab-mcp 2.3.16 (02:49 UTC today) fixes GHSA-m9qr (8.1): its Docker image, through 2.3.15, ran Node.js 22.21.1, which has the Brotli decoder flaw covered on October 26 and fixed in 22.23.4. In remote deployments the OAuth endpoints decompress request bodies before authentication.
• n8n 2.45.6 is npm latest since yesterday morning. 1.123.90, the same morning, now requires a signed token to accept an invitation (#42292); no advisory has followed.

On the Venicecom stack. open is in the table. Microsoft's Kiota 1.36.0 (October 9; 1.37.0 shipped this morning) fixes a code-generation injection in its C# generator: an OpenAPI document with crafted default values could get code into the generated client (GHSA-pwg8, high; NuGet and npm kiota). The advisory appeared at 22:13 UTC yesterday, three weeks after the fix. Generating clients from a specification you don't control is the exposure. MSRC shows no new or revised .NET, ASP.NET Core, Visual Studio or Azure records since October 28, and the out-of-band builds from October 26 stand. Angular 22.2.4 carries no security notes, and PrimeNG released nothing.

Paperwork your scanner may raise. GitHub's reviewed feed published 25 records in ten minutes, 16:32 to 16:41 UTC yesterday, and nothing since. Among them: PraisonAI's GHSA-26mh (7.3), against praisonai below 4.6.78, a version never published to PyPI (4.6.81 is the first release with the fix, covered on October 8); five Keycloak records (up to 8.1; 26.6.4 shipped on June 26, and the policy enforcer's fix is 26.0.10); four more for the Rust zip crate (9.0.0); Vite's CVE-2026-118662 (6.9 on v4), which covers only 6.4.4 and is fixed in 6.4.5, so Angular's pins (7.3.7 on 20.x and 21.x, 8.3.5 on 22.2.5) are outside it; decode-uri-component through 0.5.0 (8.2 on v4; 0.5.1 since October 23; 35 million downloads a week); and two small ones with fixes from June, @sylphx/pdf-reader-mcp 3.0.1 (7.5, an HTTP transport that accepted unauthenticated requests despite configured auth) and @eeacms/volto-chatbot 2.0.4 (8.2). pypdf's seven October 27 and 28 records gained CVE IDs (CVE-2026-119203 to CVE-2026-119209); 6.21.3 and 6.21.4 remain the fixes.

Not fixed, outside the beat: flat 6.0.1 (37 million downloads a week, newest release September 2023) has CVE-2026-119051 (8.2 on v4; 5.9 on v3.1), a denial of service in unflatten() on attacker-chosen keys, with an issue open since September 16. Twisted through 26.4.0 has an HTTP/2 denial of service (7.5) whose fix exists only in the 26.10.0 release candidates.

Standing items. CrewAI 1.15.33 now has its GitHub release (October 29, 07:36 UTC), and nothing names a fix for ZDI-26-706. MLflow's newest release is still 3.17.2 (October 21), so the fix for CVE-2026-53995 is on master only. Unchanged: vLLM 0.32.0, SGLang 0.5.22, Chroma 1.5.9, LiteLLM 1.106.6 and 1.105.7, Qdrant 1.20.0, Milvus 3.0.4 and 2.6.26, Ollama 0.40.13.