Neo4j vulnerabilities
17 published CVEs name Neo4j among the affected products.
- 17Published CVEs17 of them scored
- 13Last 12 monthspublished in the last year
- 1Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-92684
Aggregation queries can bypass authentication restrictions in @neo4j/graphql
Neo4j · @neo4j/graphql
High8.7 - CVE-2026-92683
Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql
Neo4j · @neo4j/graphql
High8.6 - CVE-2026-92681
@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields
Neo4j · @neo4j/graphql
Critical9.3 - CVE-2026-92682
@neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier
Neo4j · @neo4j/graphql
High8.6 - CVE-2026-19869
Privilege Escalation via Dropped Field-Level @authentication
neo4j · graphql
High7.6 - CVE-2026-5423
Subscription Authentication Bypass via Unverified connectionParams.jwt
neo4j · graphql
High8.2 - CVE-2026-14587
Unathenticated connection can hold Bolt channel open
neo4j · Enterprise Edition
Medium5.5 - CVE-2026-1471
Caching of authentication context
Neo4j · Enterprise edition
Low2.1 - CVE-2026-1524
Auth misconfiguration when multiple providers enabled
neo4j · Enterprise Edition
Low2.1 - CVE-2026-1497
Incorrect privilege assignment in composite databases
neo4j · Enterprise Edition
Low2.0