Neo4j

Latest CVEs · RSS

• CVE-2026-92681 2026-10-12 · CVSS 9.3
  In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently igno
• CVE-2026-92682 2026-10-12 · CVSS 8.6
  In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negat
• CVE-2026-19869 2026-08-18 · CVSS 7.6
  @neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authen
• CVE-2026-5423 2026-08-06 · CVSS 8.2
  @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription 
• CVE-2026-14587 2026-08-05 · CVSS 5.5
  Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a
• CVE-2026-1471 2026-03-11 · CVSS 2.1
  Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the f
• CVE-2026-1524 2026-03-11 · CVSS 2.1
  An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:
• CVE-2026-1497 2026-03-11 · CVSS 2.0
  Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: 
• CVE-2026-1337 2026-02-06 · CVSS 1.1
  Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs
• CVE-2026-1622 2026-02-04 · CVSS 4.8
  Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential information disclosure by a user who has ability t
• CVE-2025-12738 2026-01-22 · CVSS 1.3
  Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate acc
• CVE-2025-11602 2025-10-31 · CVSS 6.3
  Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous
• CVE-2025-10193 2025-09-11 · CVSS 7.4
  DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocati