Bug hunter tracks down three massive MCP flaws and one vendor won't fix theirs

Apache, Alibaba databases vulnerable and only one has a patch