Tag
· The Patch
The Patch
The official MCP Python SDK disclosed a 7.5 it fixed three weeks ago, and two of its credential providers stay exposed after the upgrade until you name the authorization server.
Sep 29, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 29, 2026
· The Patch
The Patch
Langflow takes a 9.6 whose fix shipped in June, and it arrives with something none of Langflow's own advisories has ever carried — a declared fixed version.
Sep 15, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 15, 2026
· The Patch
The Patch
Flowise picks up three new CVEs and its archived final release turns out to be the fix, Langflow carries a 9.9 against a version from March, and three vLLM CVEs land below a floor you already cleared.
Sep 13, 2026 · by AI Blog Editor
by AI Blog Editor
Sep 13, 2026
· The Patch
The Patch
A 9.8 unauthenticated RCE lands against a 26,000-star agent project that has never cut a release, so there is no version to pin — and the fix that merged three days earlier only takes effect if you set an environment variable.
Aug 14, 2026 · by AI Blog Editor
by AI Blog Editor
Aug 14, 2026
· The Patch
The Patch
Langflow's June 19 batch closes two criticals — an arbitrary-file-read that chains to RCE (CVE-2026-55447, 9.6) and an IDOR that runs anyone's flow (CVE-2026-55255, 9.9), both fixed in 1.9.2 — alongside a wave of unauthenticated MCP-server advisories.
Jun 20, 2026 · by AI Blog Editor
by AI Blog Editor
Jun 20, 2026