Vendor
Neo4j
23 known vulnerabilities in products by Neo4j, 0 of them actively exploited (CISA KEV).
Key figures
23
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2021-34371 | Neo4j: Deserialization of Untrusted Data | 9.8 | |
| Critical | CVE-2018-1000820 | Neo4j Awesome Procedures On Cyper: XML External Entity (XXE) | 10.0 | |
| Critical | CVE-2018-18389 | Neo4j: Improper Access Control | 9.8 | |
| Critical | CVE-2021-42767 | Neo4j Awesome Procedures: Path Traversal | 9.1 | |
| Critical | CVE-2026-92681 | @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields | — | |
| High | CVE-2022-37423 | Neo4j Awesome Procedures On Cypher: Path Traversal | 7.5 | |
| High | CVE-2026-5423 | Subscription Authentication Bypass via Unverified connectionParams.jwt | — | |
| High | CVE-2026-92682 | @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier | — | |
| High | CVE-2021-34802 | Neo4j Graph Databse: security vulnerability | 8.8 | |
| High | CVE-2026-14587 | Unathenticated connection can hold Bolt channel open | 7.5 | |
| High | CVE-2026-19869 | Privilege Escalation via Dropped Field-Level @authentication | — | |
| Critical | CVE-2026-1524 | Auth misconfiguration when multiple providers enabled | 9.8 | |
| High | CVE-2023-23926 | Neo4j Apoc: Improper Restriction of XML External Entity Reference | 5.9 | |
| High | CVE-2022-23532 | neo4j-apoc-procedures is vulnerable to path traversal | 7.1 | |
| Medium | CVE-2024-34517 | Neo4j: Modification of Assumed-Immutable Data (MAID) | 6.5 | |
| High | CVE-2026-1497 | Incorrect privilege assignment in composite databases | 7.2 | |
| Medium | CVE-2026-1471 | Caching of authentication context | 6.5 | |
| High | CVE-2025-10193 | Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks | — | |
| Medium | CVE-2025-11602 | Untargeted information leak in Bolt protocol handshake | — | |
| Medium | CVE-2026-1337 | Insufficient escaping of unicode characters in query log | 5.4 | |
| Not rated | CVE-2013-7259 | Neo4j: Cross-Site Request Forgery (CSRF) | — | |
| Medium | CVE-2026-1622 | Unredacted data exposure in query.log | — | |
| Low | CVE-2025-12738 | Enumeration of restricted property value | — |
News
- Anomalous Server Activity Prompts LexisNexis to Take Services Offlinesans-newsbites-mail,
Products
| Neo4j | 9 | 0 |
| Enterprise Edition | 8 | 0 |
| Community Edition | 4 | 0 |
| Awesome Procedures On Cyper | 3 | 0 |