Snapshot 244578
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Join us for NODES 2026: Engineering better intelligence | Nov 12 Register today Products FULLY-MANAGED AuraDB Store and query connected data at scale Virtual Graph Create and query a knowledge graph on existing data Aura Graph Analytics Run graph algorithms on any data, any cloud Aura Agent Build and deploy context-aware agents fast SELF-MANAGED Graph Database Store connected data with a graph database Graph Analytics Run graph algorithms on self-managed graph databases Graph Data Science Run graph algorithms on connected data Enterprise Studio Securely query, explore, and visualize data Fleet Manager Manage all your Neo4j deployments from one place AI CAPABILITIES Knowledge layer AI systems AI integrations GraphRAG Solutions INDUSTRIES Financial services Healthcare & life sciences Public sector Retail Telecommunications TECHNICAL PATTERNS Digital twin Knowledge graphs Pattern matching GRAPHAWARE Intelligence analysis Financial crime intelligence USE CASES AI systems Customer experiences Data privacy, risk, & compliance Fraud detection & analytics Identify & access management Master data management Network & IT Real-time recommendations Supply chain PARTNERS AWS Databricks Google Cloud Microsoft Azure Snowflake Partner directory Become a partner Customer success stories Case studies, customer videos, proof points, and more Neo4j Startup Program Why Neo4j FOR EXECUTIVES Executive insights AI systems IDC business value study Business value calculator CUSTOMERS Customer success stories Case studies, customer videos, proof points, and more Contact Sales Developers LEARNING CENTERS Dev Center Best practices, guides, tutorials, and downloads GraphAcademy Free online courses and certifications. Join the 100k+ Neo4j experts. DEV RESOURCES Community Discord Developer blog Documentation Deployment Center BUILD WITH AI AI + graph GraphRAG Agent memory Model Context Protocol (MCP) Customer support Resources LEARN Blog Announcements, guides, and best practices Customer success stories Case studies, customer videos, proof points, and more Events hub Live and on-demand events, training, webinars, and demos GraphAcademy Free online courses and certifications. Join the 100k+ Neo4j experts. Newsroom Latest news, awards, press releases, and media resources Resource library Whitepapers, datasheets, and more Video hub Covering graph databases, data science, analytics, and AI FEATURED EVENTS AWS re:Invent 2026 | Nov 30 – Dec 4 Meet us at booth #732 in Las Vegas NODES 2026 | November 12 Virtual Conference: Engineering better intelligence Careers Pricing Aura Login Support Get started free Contact us Advisories Date CVE Number CVE Title Severity Products Affected Versions Reporter 2026-11-09 CVE-2026-92683 Incomplete evaluation of multi-condition JWT “where” filter in @authentication directive High graphql library 7.x prior to 7.6.7 Internal 2026-10-12 CVE-2026-92682 authorization relationship and connection filters invert the “none” quantifier High graphql library 7.x prior to 7.6.4 Internal 2026-10-12 CVE-2026-92681 schema-level and type-level @authentication not enforced on top-level @cypher fields Critical graphql library Prior to 7.6.4 Internal 2026-08-18 CVE-2026-19869 Privilege Escalation via Dropped Field-Level @authentication High graphql library 5.x from 5.2.0 prior to 5.12.15 7.x prior to 7.6.0 Internal 2026-08-06 CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt High graphql library 5.x prior to 5.12.14 7.x prior to 7.5.6 EQSTLab 2026-08-05 CVE-2026-14587 Unathenticated connection can hold Bolt channel open Medium Neo4j Enterprise & Community 5.x prior to 5.26.29 CalVer prior to 2026.07 External 2026-03-11 CVE-2026-1524 Auth misconfiguration when multiple providers enabled Low Neo4j Enterprise 4.4.x prior to 5.26.22 CalVer prior to 2026.02 Internal 2026-03-11 CVE-2026-1497 Incorrect privilege assignment in composite databases Low Neo4j Enterprise 5.x prior to 5.26.22 CalVer prior to 2026.02 External 2026-03-11 CVE-2026-1471 Excessive caching of authentication context Low Neo4j Enterprise 4.4.x prior to 5.26.22 CalVer prior to 2026.01.4 External 2026-02-06 CVE-2026-1337 Insufficient escaping of unicode characters in query log Low Neo4j Enterprise & Community Prior to 2026.01.0 Internal 2026-02-04 CVE-2026-1622 Unredacted data exposure in query.log Medium Neo4j Enterprise & Community 4.4.x prior to 4.4.48 5.26.x prior to 5.26.21 2025.x prior to 2026.01.3 Internal 2026-01-22 CVE-2025-12738 Enumeration of restricted property value Low Neo4j Enterprise 5.26.x prior to 5.26.17 2025.x prior to 2025.11.2 Internal 2025-10-31 CVE-2025-11602 Potential information leak in Bolt protocol handshake Medium Neo4j Enterprise & Community 5.26.x prior to 5.26.15 2025.x prior to 2025.10.1 Internal 2025-09-11 CVE-2025-10193 DNS rebinding vulnerability in Neo4j Cypher MCP server High mcp-neo4j-cypher 0.2.2 to 0.3.1 Evan Harris – mcpsec.dev 2024-05-07 CVE-2024-34517 Mishandling of IMMUTABLE privileges Medium Neo4j Enterprise 5.x prior to 5.19 Internal 2023-02-16 CVE-2023-23926 XML External Entity (XXE) vulnerability in the apoc.import.graphml procedure Medium APOC core APOC extended 4.4.x prior to 4.4.0.14 5.5.x prior to 5.5.0 Christopher Schneider – State Farm 2023-01-13 CVE-2022-23532 Path Traversal Vulnerability in the apoc.export.* procedures High APOC core APOC extended 4.3.x prior to 4.3.0.12 4.4.x prior to 4.4.0.12 5.5.x prior to 5.4.0 Adam Reziouk – Airbus 2022-08-12 CVE-2022-37423 Partial Path Traversal vulnerability in apoc.log.stream Medium APOC extended 4.3.x prior to 4.3.0.7 4.4.x prior to 4.4.0.8 Jonathan Leitschuh 2022-02-01 CVE-2021-42767 Directory Traversal vulnerabilities in several apoc* functions Medium APOC extended 3.5.x prior to 3.5.0.17 4.2.x prior to 4.2.0.10 4.3.x prior to 4.3.0.4 4.4.x prior to 4.4.0.1 Nicolai Grødum – PwC Norway 2021-07-30 CVE-2021-34802 A failure in resetting the security context in some transaction actions could allow authenticated users to execute commands with elevated privileges. Medium Neo4j Enterprise 4.2.x prior to 4.2.8 Internal 2018-10-16 CVE-2018-18389 Access control bypass in LDAP authentication Critical Neo4j Enterprise 3.4.x prior to 3.4.9 oschlueter