Skip to content

Commit 6207326

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-x3cv-r3g3-fpg9 GHSA-24q9-g4p7-45qp GHSA-4pc8-6qgf-fgv2 GHSA-5j27-2fpm-q949 GHSA-5p47-92qw-3767 GHSA-6625-m396-m7cp GHSA-98hc-x583-4p47 GHSA-9q53-p4m8-gm9v GHSA-f3fr-gvgx-x9gh GHSA-fv83-x2xw-2j55 GHSA-fwx6-6883-xr45 GHSA-jgq2-vq69-gr6h GHSA-p7jp-59qp-fjf3 GHSA-pxw3-r2m4-c5m3 GHSA-q6pr-mghj-3fjx GHSA-qg37-cwrh-945r GHSA-vh49-38wc-6wqp GHSA-w67w-38wc-vr97 GHSA-wh3w-c78x-9663
1 parent bef1095 commit 6207326

File tree

19 files changed

+703
-4
lines changed

19 files changed

+703
-4
lines changed

‎advisories/github-reviewed/2026/04/GHSA-x3cv-r3g3-fpg9/GHSA-x3cv-r3g3-fpg9.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x3cv-r3g3-fpg9",
4+
"modified": "2026-04-17T21:30:50Z",
5+
"published": "2026-04-17T21:30:50Z",
6+
"aliases": [
7+
"CVE-2026-35402"
8+
],
9+
"summary": "Neo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures",
10+
"details": "### Summary\nThe `read_only` mode in `mcp-neo4j-cypher` versions prior to 0.6.0 can be bypassed using `CALL` procedures. \n### Details\n\n#### Impact\nThe enforcing of `read_only` mode in vulnerable versions could be bypassed by certain APOC procedures.\n\n#### Patches\nv0.6.0 release hardened the checks around the mode. The only way to guarantee the server actions is to limit the permissions of the db credentials available to the server.\n\n### Notes\nImpacts for server-side request forgery vulnerabilities may depend on both the configuration of the vulnerable system as well as the presence of other systems in the environment that could be accessed as part of exploitation.\n#### Recommended hardening\n\n- Limit the apoc procedures to what's required\n- [Manage data loading privileges](https://neo4j.com/docs/operations-manual/current/authentication-authorization/load-privileges/ )\n- Don't relax the default settings without compensating controls\n - `apoc.import.file.enabled` is `false` by default\n - `apoc.import.file.use_neo4j_config` is `true` by default to restrict file imports to the import folder\n\n### Credits\nWe want to publicly recognise the contribution of [Yotam Perkal](https://github.com/yotampe-pluto) from [Pluto Security](https://pluto.security/).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "mcp-neo4j-cypher"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.6.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/neo4j-contrib/mcp-neo4j/security/advisories/GHSA-x3cv-r3g3-fpg9"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/neo4j-contrib/mcp-neo4j"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/neo4j-contrib/mcp-neo4j/releases/tag/mcp-neo4j-cypher-v0.6.0"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-284"
55+
],
56+
"severity": "LOW",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-04-17T21:30:50Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/unreviewed/2026/04/GHSA-24q9-g4p7-45qp/GHSA-24q9-g4p7-45qp.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-24q9-g4p7-45qp",
4-
"modified": "2026-04-09T18:31:26Z",
4+
"modified": "2026-04-17T21:31:42Z",
55
"published": "2026-04-09T18:31:26Z",
66
"aliases": [
77
"CVE-2025-15480"
88
],
99
"details": "In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/04/GHSA-4pc8-6qgf-fgv2/GHSA-4pc8-6qgf-fgv2.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4pc8-6qgf-fgv2",
4+
"modified": "2026-04-17T21:31:48Z",
5+
"published": "2026-04-17T21:31:48Z",
6+
"aliases": [
7+
"CVE-2026-40527"
8+
],
9+
"details": "radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40527"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/radareorg/radare2/pull/25821"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/radareorg/radare2/commit/bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/radare2-command-injection-via-dwarf-parameter-names"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-78"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-04-17T21:16:35Z"
47+
}
48+
}

‎advisories/unreviewed/2026/04/GHSA-5j27-2fpm-q949/GHSA-5j27-2fpm-q949.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5j27-2fpm-q949",
4+
"modified": "2026-04-17T21:31:47Z",
5+
"published": "2026-04-17T21:31:47Z",
6+
"aliases": [
7+
"CVE-2026-35682"
8+
],
9+
"details": "Anviz CX2 Lite is vulnerable to an authenticated command injection via a \nfilename parameter that enables arbitrary command execution (e.g., \nstarting telnetd), resulting in root‑level access.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35682"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.anviz.com/contact-us.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-77"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-17T20:16:35Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-5p47-92qw-3767/GHSA-5p47-92qw-3767.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5p47-92qw-3767",
4-
"modified": "2026-04-09T18:31:26Z",
4+
"modified": "2026-04-17T21:31:42Z",
55
"published": "2026-04-09T18:31:26Z",
66
"aliases": [
77
"CVE-2025-14551"
88
],
99
"details": "In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/04/GHSA-6625-m396-m7cp/GHSA-6625-m396-m7cp.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6625-m396-m7cp",
4+
"modified": "2026-04-17T21:31:46Z",
5+
"published": "2026-04-17T21:31:46Z",
6+
"aliases": [
7+
"CVE-2026-32324"
8+
],
9+
"details": "Anviz CX7 Firmware is \nvulnerable because the application embeds reusable certificate/key \nmaterial, enabling decryption of MQTT traffic and potential interaction \nwith device messaging channels at scale.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32324"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.anviz.com/contact-us.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-321"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-17T20:16:33Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-98hc-x583-4p47/GHSA-98hc-x583-4p47.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-98hc-x583-4p47",
4+
"modified": "2026-04-17T21:31:47Z",
5+
"published": "2026-04-17T21:31:47Z",
6+
"aliases": [
7+
"CVE-2026-35546"
8+
],
9+
"details": "Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted \narchives to be accepted, enabling attackers to plant and execute code \nand obtain a reverse shell.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35546"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.anviz.com/contact-us.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-306"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-17T20:16:35Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-9q53-p4m8-gm9v/GHSA-9q53-p4m8-gm9v.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9q53-p4m8-gm9v",
4+
"modified": "2026-04-17T21:31:47Z",
5+
"published": "2026-04-17T21:31:47Z",
6+
"aliases": [
7+
"CVE-2026-35061"
8+
],
9+
"details": "Anviz CX7 Firmware is vulnerable to the most recently captured test photo that can be \nretrieved without authentication, revealing sensitive operational \nimagery.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35061"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.anviz.com/contact-us.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-862"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-04-17T20:16:35Z"
43+
}
44+
}

‎advisories/unreviewed/2026/04/GHSA-f3fr-gvgx-x9gh/GHSA-f3fr-gvgx-x9gh.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f3fr-gvgx-x9gh",
4-
"modified": "2026-04-13T09:31:33Z",
4+
"modified": "2026-04-17T21:31:43Z",
55
"published": "2026-04-13T09:31:33Z",
66
"aliases": [
77
"CVE-2026-34865"
88
],
99
"details": "Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/04/GHSA-fv83-x2xw-2j55/GHSA-fv83-x2xw-2j55.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,9 @@
3737
}
3838
],
3939
"database_specific": {
40-
"cwe_ids": [],
40+
"cwe_ids": [
41+
"CWE-295"
42+
],
4143
"severity": "HIGH",
4244
"github_reviewed": false,
4345
"github_reviewed_at": null,

0 commit comments

Comments
 (0)