LMDeploy's API server has a 9.8 in every release from 0.9.0 to 0.18.0, the newest, and the fix is a pull request that has been open since September 14. If you serve models with it, put an API key in front of it this morning. Kubeflow Pipelines 2.18.0 fixes sixteen advisories, including a 9.6 and two unauthenticated 8.6s, which this digest missed when they went up on Wednesday and Thursday.

A scanner will raise little of the AI half. GitHub's database holds LMDeploy's and n8n's CVEs as unreviewed records with no package, and Kubeflow's and Obot's advisories name container images or Go modules, two of the sixteen Kubeflow records as Go pseudo-versions. It took eleven of node-forge's seventeen last night; the two signature-forgery records aren't among them.

Worth your morning

LMDeploy: the weight-update endpoint has no lock unless you add one. CVE-2026-119706 (VulnCheck, 9.8 on v3.1) covers POST /update_weights on the OpenAI-compatible API server. The endpoint deserialises pickle data taken from the request, so a caller who can reach the port can run commands as the server process. The bug was reported in issue 4698 on June 22, and PR 4964 ("Reject pickle on HTTP /update_weights") is still open. 0.18.0 (September 28) is the newest release on PyPI. The repository has published no advisory.

At v0.18.0, lmdeploy serve api_server listens on 0.0.0.0, registers the endpoint on every server, and checks keys only when --api-keys is set. When it is, the key check covers /update_weights: the only paths it exempts are /health, /docs, /redoc and /nodes. Set a key, bind --server-name to 127.0.0.1 or a private interface, and if a reverse proxy fronts it, refuse /update_weights there unless you use it. The four advisories covered on September 17 are a different set; their fixes are all in 0.18.0.

Kubeflow Pipelines: sixteen advisories against the API server and UI, one release. The project published five advisories on Wednesday and eleven on Thursday; 2.18.0 shipped on Wednesday at 01:31 UTC. The 9.6 (GHSA-rjr3, CVE-2026-77596) lets a low-privilege tenant in a multi-user deployment create shared pipelines or add versions to existing ones. A recurring run set to follow the latest version then runs that version in its owner's namespace. The advisory adds that an API server reachable without an authenticating proxy exposes this to unauthenticated callers. The two 8.6s (GHSA-v3vh and GHSA-3pcj) are server-side request forgery in the UI frontend that needs no login in the standalone install and returns the response body. On EC2-backed clusters where pods can reach IMDSv1, that can expose the node role's temporary credentials. The rest cover cross-tenant credential minting (8.3) and run redirection (8.5), unauthenticated pod-log and file reads (7.5 each), a decompression bomb (7.5) and eight mediums. Upgrade to 2.18.0, keep the API server behind the authenticating proxy, and require IMDSv2 on the nodes. The project wasn't on this digest's watch list, only Kubeflow's hub; it is now.

Obot: an MCP gateway fixed eleven days before it said why. Five advisories went up at 00:36 UTC today against v0.26.3 and earlier, all fixed in v0.27.0 (October 20). The 8.0 (GHSA-x3hf) could hand an attacker an access token issued to a victim for another service behind the same authorization server, with scopes the attacker chose; the victim sees only a real consent screen. The 7.6 (GHSA-57qx) needs administrator-level access and makes the server send requests to internal addresses or a cloud metadata service. The 6.4 runs commands in the unprivileged init container that provisions a Docker MCP server's files, which reaches Obot's Docker network but not the host. The v0.28.0 alphas are pre-releases; v0.27.0 is the one to run.

n8n: a Databricks node with no fix yet. CVE-2026-119557 (VulnCheck, 8.2 on v4, 5.9 on v3.1) says the Databricks node from 2.14.0 through 2.46.3 builds API paths from resource identifiers without encoding them. A workflow that passes webhook, form or chat input into the node's space, index or file-path fields therefore lets an outside caller reach other Databricks endpoints with the stored credential and read secrets. 2.46.3 (the next line) and 2.45.7 (latest) both shipped yesterday morning, and the node's last change was the October 28 bundle. The record links two September n8n advisories about the n8n and Supabase nodes; neither covers Databricks. Until a fix lands, check workflows that map untrusted input into that node.

node-forge: seventeen advisories, two of them signature forgeries. The maintainers published them on Tuesday between 04:53 and 05:09 UTC, minutes after 1.4.1 (04:44); 1.4.2 followed the same afternoon. Two records (GHSA-6qrw and GHSA-2g46, 7.5 each) say forge accepted forged RSA PKCS#1 v1.5 signatures. Two more say verifyCertificateChain() let a certificate without CA rights act as an issuer (7.4) and didn't enforce path-length limits (5.9). The rest are denial of service in TLS, PEM and ASN.1 parsing, PKCS#12 integrity with a zero iteration count, and smaller items. Every range is ≤ 1.4.0, and the consumers checked here (selfsigned 2.x, google-p12-pem) declare ^1 ranges, so a lockfile refresh reaches 1.4.2. Angular's current builders (22.2.5, 21.2.29, 20.3.42) no longer pull it in through selfsigned. node-forge (53 million downloads a week) wasn't on the watch list either, so this is four days late.

Visual Studio, out of band. MSRC published CVE-2026-118147 on Friday: improper certificate validation that allows network spoofing (7.4, Important; not disclosed or exploited). Fixed builds: Visual Studio 2026 18.11.3, 2022 17.14.44, 2019 16.11.62 and 2017 15.9.84. No .NET runtime, ASP.NET Core or Azure record moved, and Angular and PrimeNG released nothing.

Also on the AI stack.

• Flowise through 3.1.4: CVE-2026-119978 (9.0 on v4) is another sandbox escape in the custom function node, open to authenticated users, but only with ALLOW_BUILTIN_DEP=true; the shipped .env.example leaves it false. The repository has been archived since August 13, so no fix is coming. Leave the setting off.
• fickling through 0.1.12 (CVE-2026-118938, 8.8): Trail of Bits' pickle checker can report a malicious pickle as safe. The cited fix (d011709) landed on master on Friday, 40 commits past v0.1.12 (June 26), and no release carries it. A safety scanner needs the release more than most tools do. Don't let a fickling pass be the only gate on model files from outside.
• pyasn1 0.6.5 (Tuesday; 117 million downloads a week) fixes four quadratic-time denial-of-service records rated 7.5, which GitHub indexed last night. rsa, pyasn1-modules and ldap3 all accept 0.6.5.
• oauthlib 4.0.0 (September 28) is the fix for two provider-side advisories published October 23 and 24: a confidential client with valid credentials could get tokens under another client's grant and scopes (GHSA-7984, 8.4 on v4), and the device flow could release a bearer token to a client that knew a valid client ID (GHSA-3jp2). Client-side users of requests-oauthlib aren't the exposure; OAuth servers built on oauthlib are.

Paperwork your scanner may raise. GitHub's reviewed feed published 70 records yesterday, mostly between 22:51 and 23:13 UTC. Most are old fixes or covered here before. pypa/gh-action-pypi-publish GHSA-5xjx is rated 9.3 for bundling the eMudhra (emSign) roots covered on October 21; 1.14.3 (October 20) drops them, and uv's matching advisory gained CVE-2026-119327. Authlib's GHSA-c73q (8.8, fixed 1.9.1) and pypdf's seven records (6.21.3 and 6.21.4) are now reviewed. follow-redirects' GHSA-mrwp, a 5.9 from the maintainers and covered on October 21, is 8.2 on v4 in GitHub's copy. CVE backfills: RAGFlow's agent authorization flaw (CVE-2026-119337, fixed in 0.27.3), n8n's deprecated code nodes (CVE-2026-119408 for GHSA-9p7v, covered on October 29), the MoLing MCP server's SSE mode (CVE-2026-62863, 9.6, fixed in 0.5.0 in March), LM Studio's model downloader (CVE-2026-119979, 8.8, fixed in 0.4.22 build 1, whose changelog doesn't mention it; 0.4.26 is out), and Refitter's .NET client generator (CVE-2026-63184, 7.1, fixed in 2.1.1; 2.3.1 is current). joserfc's two denial-of-service records are fixed in 1.7.5 and 1.7.6; 1.7.7 is current.

Standing items. No advisories yet for Open WebUI 0.12.5; the repository's newest is still from October 18. Agno is still on 3.1.12, and tools/pandas.py hasn't changed since April. mcp-remote 0.15.2 still declares open ^10.1.0. MLflow's newest release is still 3.17.2, so the CVE-2026-53995 fix is on master only. Langflow 1.13.0 remains the floor; 1.13.1rc2 is a pre-release. CrewAI 1.15.33 names no fix for ZDI-26-706.