Neo4j

Products

Exploited and recent CVEs

• CVE-2026-92681 Critical 9.3 @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields 0.4%
• CVE-2026-92682 High 8.6 @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier 0.3%
• CVE-2026-19869 High 7.6 Privilege Escalation via Dropped Field-Level @authentication 0.5%
• CVE-2026-5423 High 8.2 Subscription Authentication Bypass via Unverified connectionParams.jwt 0.6%
• CVE-2026-14587 Medium 5.5 Unathenticated connection can hold Bolt channel open 0.5%
• CVE-2026-14587 Medium 5.5 Unathenticated connection can hold Bolt channel open 0.5%
• CVE-2026-1471 Low 2.1 Caching of authentication context 0.3%
• CVE-2026-1524 Low 2.1 Auth misconfiguration when multiple providers enabled 0.4%
• CVE-2026-1497 Low 2.0 Incorrect privilege assignment in composite databases 0.3%
• CVE-2026-1337 Low 1.1 Insufficient escaping of unicode characters in query log 0.2%
• CVE-2026-1337 Low 1.1 Insufficient escaping of unicode characters in query log 0.2%
• CVE-2026-1622 Medium 4.8 Unredacted data exposure in query.log 0.2%
• CVE-2026-1622 Medium 4.8 Unredacted data exposure in query.log 0.2%
• CVE-2025-12738 Low 1.3 Enumeration of restricted property value 0.4%
• CVE-2025-11602 Medium 6.3 Untargeted information leak in Bolt protocol handshake 0.3%
• CVE-2025-11602 Medium 6.3 Untargeted information leak in Bolt protocol handshake 0.3%
• CVE-2025-10193 High 7.4 Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks 0.2%
• CVE-2024-34517 Medium 6.5 The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access. 0.6%
• CVE-2023-23926 Medium 5.9 APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 0.9%