https://vulnogram.org/ Most recent CVEs assigned by Neo4j (neo4j). https://vulnogram.org/seaview/icons/neo4j.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-92681 https://vulnogram.org/CVE-2026-92681 In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed di… Critical Network Exploitable Mon, 12 Oct 2026 15:09:49 GMT https://vulnogram.org/CVE-2026-92682 https://vulnogram.org/CVE-2026-92682 In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related… High Mon, 12 Oct 2026 15:07:44 GMT https://vulnogram.org/CVE-2026-19869 https://vulnogram.org/CVE-2026-19869 @neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authenti… High Tue, 18 Aug 2026 16:35:19 GMT https://vulnogram.org/CVE-2026-5423 https://vulnogram.org/CVE-2026-5423 @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-o… High Network Exploitable Thu, 06 Aug 2026 15:15:29 GMT https://vulnogram.org/CVE-2026-14587 https://vulnogram.org/CVE-2026-14587 Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the d… Medium Network Exploitable Wed, 05 Aug 2026 16:10:47 GMT https://vulnogram.org/CVE-2026-1471 https://vulnogram.org/CVE-2026-1471 Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default con… Low Wed, 11 Mar 2026 16:30:24 GMT https://vulnogram.org/CVE-2026-1524 https://vulnogram.org/CVE-2026-1524 An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them… Low Wed, 11 Mar 2026 16:16:35 GMT https://vulnogram.org/CVE-2026-1497 https://vulnogram.org/CVE-2026-1497 Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.… Low Wed, 11 Mar 2026 15:50:57 GMT https://vulnogram.org/CVE-2026-1337 https://vulnogram.org/CVE-2026-1337 Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but thi… Low Fri, 06 Feb 2026 13:13:19 GMT https://vulnogram.org/CVE-2026-1622 https://vulnogram.org/CVE-2026-1622 Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential information disclosure by a user who has ability to access the local log files. The "obfuscate_literals" option in the query logs does not r… Medium Wed, 04 Feb 2026 09:14:46 GMT https://vulnogram.org/CVE-2025-12738 https://vulnogram.org/CVE-2025-12738 Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property t… Low Thu, 22 Jan 2026 13:29:11 GMT https://vulnogram.org/CVE-2025-11602 https://vulnogram.org/CVE-2025-11602 Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses. Medium Network Exploitable Fri, 31 Oct 2025 10:20:17 GMT https://vulnogram.org/CVE-2025-10193 https://vulnogram.org/CVE-2025-10193 DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being entic… High Network Exploitable Thu, 11 Sep 2025 14:05:30 GMT