NE
Vendor
Neo4j
32
CVEs
0
On KEV
2
New 30D
Products
NE9.3
@neo4j/graphql
Neo4j
2 CVEs0 on KEV2 new
NE9.8
Neo4j
Neo4j
9 CVEs0 on KEV0 new
EE9.8
Enterprise edition
neo4j
8 CVEs0 on KEV0 new
CE7.5
Community Edition
neo4j
4 CVEs0 on KEV0 new
AP10.0
Awesome Procedures ON Cyper
Neo4j
3 CVEs0 on KEV0 new
GR8.2
graphql
neo4j
2 CVEs0 on KEV0 new
AP9.1
Awesome Procedures
Neo4j
1 CVEs0 on KEV0 new
AP7.5
Awesome Procedures ON Cypher
Neo4j
1 CVEs0 on KEV0 new
GD8.8
Graph Databse
Neo4j
1 CVEs0 on KEV0 new
NM7.4
neo4j-cypher MCP server
neo4j
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-92681 | NE @neo4j/graphql Neo4j | 9.3 | Oct 12 | @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields |
| CVE-2026-92682 | NE @neo4j/graphql Neo4j | 8.6 | Oct 12 | @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier |
| CVE-2026-19869 | GR graphql neo4j | 7.6 | Aug 18 | Privilege Escalation via Dropped Field-Level @authentication |
| CVE-2026-5423 | GR graphql neo4j | 8.2 | Aug 6 | Subscription Authentication Bypass via Unverified connectionParams.jwt |
| CVE-2026-14587 | EE Enterprise Edition neo4j | 7.5 | Aug 5 | Unathenticated connection can hold Bolt channel open |
| CVE-2026-1471 | EE Enterprise edition Neo4j | 6.5 | Mar 11 | Caching of authentication context |
| CVE-2026-1524 | EE Enterprise Edition neo4j | 9.8 | Mar 11 | Auth misconfiguration when multiple providers enabled |
| CVE-2026-1497 | EE Enterprise Edition neo4j | 7.2 | Mar 11 | Incorrect privilege assignment in composite databases |
| CVE-2026-1337 | CE Community Edition neo4j | 5.4 | Feb 6 | Insufficient escaping of unicode characters in query log |
| CVE-2026-1622 | CE Community Edition neo4j | 4.8 | Feb 4 | Unredacted data exposure in query.log |
| CVE-2025-12738 | EE Enterprise Edition neo4j | 1.3 | Jan 22 | Enumeration of restricted property value |
| CVE-2025-11602 | EE Enterprise Edition neo4j | 6.3 | Oct 31 | Untargeted information leak in Bolt protocol handshake |
| CVE-2025-10193 | NM neo4j-cypher MCP server neo4j | 7.4 | Sep 11 | Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks |
| CVE-2024-34517 | NE Neo4j Neo4j | 6.5 | May 7 | The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access |
| CVE-2023-23926 | AP Awesome Procedures ON Cyper Neo4j | 8.1 | Feb 16 | APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j |
| CVE-2022-23532 | AP Awesome Procedures ON Cyper Neo4j | 6.5 | Jan 14 | APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions |
| CVE-2022-37423 | AP Awesome Procedures ON Cypher Neo4j | 7.5 | Aug 12 | Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream |
| CVE-2021-42767 | AP Awesome Procedures Neo4j | 9.1 | Mar 1 | A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files |
| CVE-2021-34371 | NE Neo4j Neo4j | 9.8 | Aug 5 | Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable |
| CVE-2021-34802 | GD Graph Databse Neo4j | 8.8 | Jul 30 | A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users to execute commands with elevated… |
| CVE-2018-1000820 | AP Awesome Procedures ON Cyper Neo4j | 10.0 | Dec 20 | neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential… |
| CVE-2018-18389 | NE Neo4j Neo4j | 9.8 | Oct 16 | Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization,… |
| CVE-2013-7259 | NE Neo4j Neo4j | – | Apr 29 | Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary… |