Skip to content
Neo4j vulnerabilities
Newest
-
neo4j @neo4j/graphql
@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields
CVE-2026-92681
9.3 Critical
-
neo4j @neo4j/graphql
@neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier
CVE-2026-92682
8.6 High
-
@tinacms graphql
Privilege Escalation via Dropped Field-Level @authentication
CVE-2026-19869
7.6 High
-
@tinacms graphql
Subscription Authentication Bypass via Unverified connectionParams.jwt
CVE-2026-5423
8.2 High
-
neo4j, neo4j community edition, enterprise edition +2 more
Unathenticated connection can hold Bolt channel open
CVE-2026-14587
Fix available
5.5 Medium
-
neo4j enterprise edition, neo4j +1 more
Caching of authentication context
CVE-2026-1471
Fix available
2.1 Low
-
neo4j enterprise edition, neo4j +1 more
Auth misconfiguration when multiple providers enabled
CVE-2026-1524
Fix available
2.1 Low
-
neo4j enterprise edition, neo4j +1 more
Incorrect privilege assignment in composite databases
CVE-2026-1497
Fix available
2.0 Low
-
neo4j community edition, neo4j, neo4j enterprise edition +2 more
Insufficient escaping of unicode characters in query log
CVE-2026-1337
Public exploitFix available
1.1 Low
-
neo4j community edition, enterprise edition +1 more
Unredacted data exposure in query.log
CVE-2026-1622
Fix available
4.8 Medium
-
neo4j enterprise edition
Enumeration of restricted property value
CVE-2025-12738
1.3 Low
-
cloudpanel community edition
CloudPanel Community Edition HTTP Header users redirect
CVE-2025-15241
5.1 Medium
-
neo4j community edition, openclinica +1 more
OpenClinica Community Edition CRF Data Import ImportCRFData path traversal
CVE-2025-12922
5.3 Medium
-
neo4j community edition, openclinica +1 more
OpenClinica Community Edition CRF Data Import ImportCRFData xml injection
CVE-2025-12921
5.3 Medium
-
logicaldoc community edition, logicaldoc +1 more
LogicalDOC Community Edition Admin Login login.jsp excessive authentication
CVE-2025-12547
6.3 Medium
-
logicaldoc community edition, logicaldoc +1 more
LogicalDOC Community Edition API Key creation UI cross site scripting
CVE-2025-12546
5.1 Medium
-
neo4j community edition, enterprise edition +1 more
Untargeted information leak in Bolt protocol handshake
CVE-2025-11602
6.3 Medium
-
logicaldoc community edition, logicaldoc +1 more
LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting
CVE-2025-11946
5.1 Medium
-
neo4j neo4j-cypher mcp server
Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks
CVE-2025-10193
Fix available
7.4 High
-
mist community edition, mist +1 more
Mist Community Edition Authentication Endpoint views.py login cross site scripting
CVE-2025-5412
5.1 Medium
-
mist community edition, mist +1 more
Mist Community Edition views.py tag_resources cross site scripting
CVE-2025-5411
5.1 Medium
-
mist community edition, mist +1 more
Mist Community Edition middleware.py session_start_response cross-site request forgery
CVE-2025-5410
5.3 Medium
-
mist community edition, mist +1 more
Mist Community Edition API Token views.py create_token access control
CVE-2025-5409
6.9 Medium
-
neo4j
Neo4j Cypher component mishandles IMMUTABLE privileges
CVE-2024-34517
Fix available
6.5 Medium
-
neo4j apoc, awesome procedures on cyper +1 more
XML External Entity (XXE) vulnerability in apoc.import.graphml
CVE-2023-23926
Fix available
5.9 Medium
-
neo4j-contrib neo4j-apoc-procedures, neo4j awesome procedures on cyper +1 more
neo4j-apoc-procedures is vulnerable to path traversal
CVE-2022-23532
Fix available
7.1 High
-
neo4j awesome procedures on cypher
Neo4j Graph apoc plugins Partial Path Traversal Vulnerability
CVE-2022-37423
Fix available
7.5 High
-
neo4j awesome procedures
Neo4j Graph Database vulnerable to Path Traversal
CVE-2021-42767
Fix available
9.1 Critical
-
neo4j
Deserialization of Untrusted Data in Neo4j
CVE-2021-34371
Public exploitFix available
EPSS 13.4%
9.8 Critical
-
neo4j graph databse
Improper Privilege Management in Neo4j Graph Database
CVE-2021-34802
Fix available
8.8 High
-
neo4j awesome procedures on cyper
XML External Entity (XXE) vulnerability in neo4j.procedure:apoc
CVE-2018-1000820
Fix available
10.0 Critical
-
neo4j
Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication
CVE-2018-18389
Fix available
9.8 Critical
-
neo4j
Neo4J vulnerable to Cross-Site Request Forgery
CVE-2013-7259
Fix available
6.8 Medium