CVE-2026-5423 | | | 2026-08-06 | @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription… |
CVE-2026-14587 | | | 2026-08-05 | Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends… |
CVE-2026-1524 | Critical | 9.8 | 2026-03-11 | An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions… |
CVE-2026-1471 | Medium | 6.5 | 2026-03-11 | Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the… |
CVE-2026-1497 | High | 7.2 | 2026-03-11 | Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: … |
CVE-2026-1337 | Medium | 5.4 | 2026-02-06 | Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs… |
CVE-2026-1622 | | | 2026-02-04 | Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential information disclosure by a user who has ability… |
CVE-2025-12738 | | | 2026-01-22 | Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate ac… |
CVE-2025-11602 | | | 2025-10-31 | Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previou… |
CVE-2025-10193 | | | 2025-09-11 | DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocat… |
CVE-2024-34517 | Medium | 6.5 | 2024-05-07 | The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access. |
CVE-2023-23926 | Medium | 5.9 | 2023-02-16 | APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of AP… |
CVE-2022-23532 | High | 7.1 | 2023-01-14 | APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vulnerability found in… |
CVE-2022-37423 | High | 7.5 | 2022-08-12 | Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream. |
CVE-2021-42767 | Critical | 9.1 | 2022-03-01 | A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local… |
CVE-2021-34371 | Critical | 9.8 | 2021-08-05 | Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An at… |
CVE-2021-34802 | High | 8.8 | 2021-07-30 | A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users to execute commands… |
CVE-2018-1000820 | Critical | 10.0 | 2018-12-20 | neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosur… |
CVE-2018-18389 | Critical | 9.8 | 2018-10-16 | Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Accoun… |
CVE-2013-7259 | | | 2014-04-29 | Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests th… |