Neo4j vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20241
3. 20252
4. 202611

Newest CVEs

• CVE-2026-92681

  @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields

  Neo4j · @neo4j/graphql

  Critical9.3
• CVE-2026-92682

  @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

  Neo4j · @neo4j/graphql

  High8.6
• CVE-2026-19869

  Privilege Escalation via Dropped Field-Level @authentication

  neo4j · graphql

  High7.6
• CVE-2026-5423

  Subscription Authentication Bypass via Unverified connectionParams.jwt

  neo4j · graphql

  High8.2
• CVE-2026-14587

  Unathenticated connection can hold Bolt channel open

  neo4j · Enterprise Edition

  Medium5.5
• CVE-2026-1471

  Caching of authentication context

  Neo4j · Enterprise edition

  Low2.1
• CVE-2026-1524

  Auth misconfiguration when multiple providers enabled

  neo4j · Enterprise Edition

  Low2.1
• CVE-2026-1497

  Incorrect privilege assignment in composite databases

  neo4j · Enterprise Edition

  Low2.0
• CVE-2026-1337

  Insufficient escaping of unicode characters in query log

  neo4j · Enterprise Edition

  Low1.1
• CVE-2026-1622

  Unredacted data exposure in query.log

  neo4j · Enterprise Edition

  Medium4.8