Neo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures

SummaryThe readonly mode in mcp-neo4j-cypher versions prior to 0.6.0 can be bypassed using CALL procedures. Details ImpactThe enforcing of readonly mode in vulnerable versions could be bypassed by certain APOC procedures. Patchesv0.6.0 release hardened the checks around the mode. The only way to...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization in the CSV import process. An attacker can gain unauthorized access to other user accounts by uploading a crafted CSV file to overwrite non-admin user...

PT-2026-51619

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.1 Description An improper access control issue exists in the CSV user import functionality when used in update mode. A user granted the import permission can overwrite the email address of any non-admin user by...

CVE-2026-41419

The CVE describes a path traversal vulnerability in 4ga Boards prior to version 3.3.5. An authenticated user with board import privileges can cause the server to ingest arbitrary host files as board attachments during a BOARDS archive import. Once imported, those files may be downloaded via the s...

PT-2026-35064

Name of the Vulnerable Software and Affected Versions 4ga Boards versions prior to 3.3.5 Description A path traversal issue allows an authenticated user with board import privileges to force the server to ingest arbitrary host files as board attachments during the BOARDS archive import process...

OpenProject 路径遍历漏洞

OpenProject is an open-source web-based project management software. Versions of OpenProject prior to 17.2.0 had a path traversal vulnerability. This vulnerability stemmed from authenticated project members with BCF import privileges being able to upload custom.bcf archives. In such archives, the...

TIBCO Software EBX Add-ons SQL注入漏洞

TIBCO Software EBX Add-ons is an add-on from TIBCO Software, Inc. that enhances the functionality of the Tibco Ebx data management platform. A security vulnerability exists in TIBCO EBX Add-ons versions 4.5.17 and earlier, 5.6.2 and earlier, and 6.1.0, which stems from an easily exploitable...