Critical
CVE-2026-41274
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execut…
Tag: Neo4j
All CVEs associated with "Neo4j". Page 1/1 • 24 CVEs.
About “Neo4j”
A curated feed of “Neo4j”-related CVEs appears below. We currently track 24 CVEs for this tag (all time). In the last 365 days, 14 were published. Average CVSS is 7.1 (all time; 6.4 over 365d), and 58% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-943 - Improper Neutralization of Special Elements in Data Query Logic, CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE-863 - Incorrect Authorization.
In our taxonomy this topic maps to a MODERATE impact class. Databases, proxies, and web servers often need coordinated restarts and config checks. Patch only modules you deploy, verify TLS and authentication, and tune limits. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.
Support & lifecycle: neo4j
This table shows recent release cycles and their projected end-of-life. Data source: endoflife.date.
| Cycle | Release | Latest | EOL | LTS |
|---|---|---|---|---|
| 2026.04 | 2026.04.0 | - | ||
| 2026.03 | 2026.03.1 | Expired | ||
| 2026.02 | 2026.02.3 | Expired | ||
| 2026.01 | 2026.01.4 | Expired | ||
| 2025.12 | 2025.12.1 | Expired | ||
| 2025.11 | 2025.11.2 | Expired | ||
| 2025.10 | 2025.10.1 | Expired | ||
| 2025.09 | 2025.09.0 | Expired | ||
| 2025.08 | 2025.08.0 | Expired | ||
| 2025.07 | 2025.07.1 | Expired | ||
| 2025.06 | 2025.06.2 | Expired | ||
| 2025.05 | 2025.05.1 | Expired | ||
| 2025.04 | 2025.04.0 | Expired | ||
| 2025.03 | 2025.03.0 | Expired | ||
| 2025.02 | 2025.02.0 | Expired | ||
| 2025.01 | 2025.01.0 | Expired | ||
| 5.26 | 5.26.26 | LTS | ||
| 5.25 | 5.25.1 | Expired | ||
| 5.24 | 5.24.2 | Expired | ||
| 5.23 | 5.23.0 | Expired | ||
| 5.22 | 5.22.0 | Expired | ||
| 5.21 | 5.21.2 | Expired | ||
| 5.20 | 5.20.0 | Expired | ||
| 5.19 | 5.19.0 | Expired | ||
| 5.18 | 5.18.1 | Expired | ||
| 5.17 | 5.17.0 | Expired | ||
| 5.16 | 5.16.0 | Expired | ||
| 5.15 | 5.15.0 | Expired | ||
| 5.14 | 5.14.0 | Expired | ||
| 5.13 | 5.13.0 | Expired | ||
| 5.12 | 5.12.0 | Expired | ||
| 5.11 | 5.11.0 | Expired | ||
| 5.10 | 5.10.0 | Expired | ||
| 5.9 | 5.9.0 | Expired | ||
| 5.8 | 5.8.0 | Expired | ||
| 5.7 | 5.7.0 | Expired | ||
| 5.6 | 5.6.0 | Expired | ||
| 5.5 | 5.5.0 | Expired | ||
| 5.4 | 5.4.0 | Expired | ||
| 5.3 | 5.3.0 | Expired | ||
| 5.2 | 5.2.0 | Expired | ||
| 5.1 | 5.1.0 | Expired | ||
| 4.4 | 4.4.48 | Expired | LTS | |
| 4.3 | 4.3.23 | Expired | ||
| 4.2 | 4.2.19 | Expired | ||
| 4.1 | 4.1.12 | Expired | ||
| 4.0 | 4.0.12 | Expired | ||
| 3.5 | 3.5.35 | Expired | ||
| 3.4 | 3.4.18 | Expired | ||
| 3.3 | 3.3.9 | Expired | ||
| 3.2 | 3.2.14 | Expired | ||
| 3.1 | 3.1.9 | Expired | ||
| 3.0 | 3.0.12 | Expired | ||
| 2.3 | 2.3.12 | Expired | ||
| 2.2 | 2.2.10 | Expired | ||
| 2.1 | 2.1.8 | Expired | ||
| 2.0 | 2.0.5 | Expired | ||
| 1.9 | 1.9.9 | Expired | ||
| 1.8 | 1.8.3 | Expired | ||
| 1.7 | 1.7.2 | Expired | ||
| 1.6 | 1.6.3 | Expired | ||
| 1.5 | 1.5.3 | Expired | ||
| 1.4 | 1.4.2 | Expired | ||
| 1.3 | 1.3.0 | Expired | ||
| 1.2 | 1.2.0 | Expired | ||
| 1.1 | 1.1.0 | Expired | ||
| 1.0 | 1.0.0 | Expired |
Maintained Soon (≤ 180 days) Expired
Subscribe lifecycle: RSS · RSS (expired) · ICS
Subscribe CVEs: RSS for “Neo4j” · RSS (High+Critical only)
CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).
CVSS ≥ 0.0
2026-04-23
2026-04-17
Low
CVE-2026-35402
mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode enforcement can be bypassed using APOC CALL procedures, potentia…
2026-03-27
High
CVE-2026-22743
Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as a filter expression key in Neo4jVectorF…
2026-03-12
High
CVE-2026-32247
Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter constructio…
2026-03-11
Critical
CVE-2026-1524
An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or mo…
Medium
CVE-2026-1471
Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after resta…
High
CVE-2026-1497
Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an…
2026-02-06
Medium
CVE-2026-1337
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. The…
2026-02-04
Medium
CVE-2026-1622
Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential information disclosure by a user who has ability to access the local log files. The "ob…
2026-01-22
Low
CVE-2025-12738
Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability…
2026-01-14
Medium
CVE-2025-66169
Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0 Users are reco…
2025-10-31
Medium
CVE-2025-11602
Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no contr…
2025-09-11
High
CVE-2025-10193
DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP i…
2025-09-10
High
CVE-2025-56406
An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication i…
2024-05-07
Medium
CVE-2024-34517
The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access.
2023-02-16
Medium
CVE-2023-23926
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 an…
2023-01-14
High
CVE-2022-23532
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vulnerability found in the apoc.export.* procedures of apoc plu…
2022-08-12
High
CVE-2022-37423
Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream.
2022-03-01
Critical
CVE-2021-42767
A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10,…
2021-08-05
Critical
CVE-2021-34371
Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code ex…
2021-07-30
High
CVE-2021-34802
A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users to execute commands with elevated privileges.
2018-12-20
Critical
CVE-2018-1000820
neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of servic…
2018-10-16
Critical
CVE-2018-18389
Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker…
2014-04-29
Medium
CVE-2013-7259
Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrat…