Login Request a demo
NE
Product
Neo4j
by Neo4j · last CVE Aug 5, 2026
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 3High 2Medium 3Low 0
Severity
All severities9Critical3High2Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Neo4j to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-1524
9.8
0%
Mar 11
Auth misconfiguration when multiple providers enabled
Affected: before 5.26.22; 2025.01.0 before 2026.02.0
CVE-2021-34371
9.8
13%
Aug 5
Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable
Affected: through 3.4.18
CVE-2018-18389
9.8
2%
Oct 16
Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization,…
Affected: 3.4.0 before 3.4.9
CVE-2026-14587
7.5
1%
Aug 5
Unathenticated connection can hold Bolt channel open
Affected: 5.0.0 before 5.26.29; 5.0.0 before 5.26.29; 2025.01.0 before 2026.07.0; 2025.01.0 before 2026.07.0
CVE-2026-1497
7.2
0%
Mar 11
Incorrect privilege assignment in composite databases
Affected: before 5.26.22; 2025.01.0 before 2026.02.0
CVE-2026-1471
6.5
0%
Mar 11
Caching of authentication context
Affected: before 5.26.22; 2025.01.0 before 2026.01.4
CVE-2024-34517
6.5
1%
May 7
The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access
Affected: 5.0.0 before 5.19
CVE-2026-1337
5.4
0%
Feb 6
Insufficient escaping of unicode characters in query log
Affected: before 2026.01.0; before 2026.01.0
CVE-2013-7259
–
1%
Apr 29
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary…
Affected: 1.9.2
Showing 9