Improper Output Neutralization for Logs

Overview org.neo4j:neo4j is a Neo4j is a graph database management system developed by Neo4j, Inc. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs due to insufficient escaping of unicode characters in query.log output. A user can inject a malicious log...

com.tinkerpop.blueprints:blueprints-neo4j-graph (2.0.0), com.tinkerpop.blueprints:blueprints-neo4jbatch-graph (2.0.0) +1 more potentially affected by CVE-2026-1337 via org.neo4j:neo4j (1.8.m02)

org.neo4j:neo4j MAVEN version 1.8.m02 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.tinkerpop.blueprints:blueprints-neo4j-graph 2.0.0 - com.tinkerpop.blueprints:blueprints-neo4jbatch-graph 2.0.0 -...

com.countvajhula:pilot (1.0), com.tinkerpop.blueprints:blueprints-neo4j-graph (1.2) +1 more potentially affected by CVE-2026-1337 via org.neo4j:neo4j (1.6.1)

org.neo4j:neo4j MAVEN version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.countvajhula:pilot 1.0 - com.tinkerpop.blueprints:blueprints-neo4j-graph 1.2 -...

org.neo4j:neo4j-graph-collections (0.3) potentially affected by CVE-2026-1337 via org.neo4j:neo4j (1.7)

org.neo4j:neo4j MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.neo4j:neo4j-graph-collections 0.3 Source cves: CVE-2026-1337 Source advisory: OSV:GHSA-XR72-G735-4VWP...

Evaluating and Enhancing the Vulnerability Reasoning Capabilities of Large Language Models

Large Language Models LLMs have demonstrated remarkable proficiency in vulnerability detection. However, a critical reliability gap persists: models frequently yield correct detection verdicts based on hallucinated logic or superficial patterns that deviate from the actual root cause. This...

Beyond Function-Level Analysis: Context-Aware Reasoning for Inter-Procedural Vulnerability Detection

Recent progress in ML and LLMs has improved vulnerability detection, and recent datasets have reduced label noise and unrelated code changes. However, most existing approaches still operate at the function level, where models are asked to predict whether a single function is vulnerable without...

com.countvajhula:pilot (1.0), com.tinkerpop.blueprints:blueprints-neo4j-graph (1.2) +1 more potentially affected by CVE-2026-1622 via org.neo4j:neo4j (1.6.1)

org.neo4j:neo4j MAVEN version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.countvajhula:pilot 1.0 - com.tinkerpop.blueprints:blueprints-neo4j-graph 1.2 -...

com.countvajhula:pilot (1.0), org.neo4j:neo4j-graph-collections (0.2) +2 more potentially affected by CVE-2026-1622 via org.neo4j:neo4j (1.6)

org.neo4j:neo4j MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.countvajhula:pilot 1.0 - org.neo4j:neo4j-graph-collections 0.2 - org.springframework.data:spring-data-neo4j-aspects...

org.neo4j:neo4j-graph-collections (0.3) potentially affected by CVE-2026-1622 via org.neo4j:neo4j (1.7)

org.neo4j:neo4j MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.neo4j:neo4j-graph-collections 0.3 Source cves: CVE-2026-1622 Source advisory: OSV:GHSA-4J3G-RWWQ-4P54...

com.tinkerpop.blueprints:blueprints-neo4j-graph (2.0.0), com.tinkerpop.blueprints:blueprints-neo4jbatch-graph (2.0.0) +1 more potentially affected by CVE-2026-1622 via org.neo4j:neo4j (1.8.m02)

org.neo4j:neo4j MAVEN version 1.8.m02 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.tinkerpop.blueprints:blueprints-neo4j-graph 2.0.0 - com.tinkerpop.blueprints:blueprints-neo4jbatch-graph 2.0.0 -...

Parse Server - GraphQL Schema Information Disclosure

The Parse Server GraphQL API previously allowed public access to the GraphQL schema without requiring a session token or the master key. While schema introspection reveals only metadata and not actual data, this metadata can still expand the potential attack surface. id: CVE-2025-53364 info: name...

CVE-2025-7105

A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in /api/convos/fork to fork numerous contents rapidly. If the forked content includes a Mermaid graph with a large number of nodes, it can lead to a JavaScript heap out of memory error upon service...

CVE-2025-7105

A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in "/api/convos/fork" to fork numerous contents rapidly. If the forked content includes a Mermaid graph with a large number of nodes, it can lead to a JavaScript heap out of memory error upon servi...

PYSEC-2026-115

OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting XSS attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET request with a malicious payload in the query string, leading to execution of JavaScript in the victim's browser. For...

Optimal Transport-Guided Adversarial Attacks on Graph Neural Network-Based Bot Detection

The rise of bot accounts on social media poses significant risks to public discourse. To address this threat, modern bot detectors increasingly rely on Graph Neural Networks GNNs. However, the effectiveness of these GNN-based detectors in real-world settings remains poorly understood. In practice...

Rust and Go Directed Fuzzing with LibAFL-DiFuzz

In modern SSDLC, program analysis and automated testing are essential for minimizing vulnerabilities before software release, with fuzzing being a fast and widely used dynamic testing method. However, traditional coverage-guided fuzzing may be less effective in specific tasks like verifying stati...

PT-2026-5332

birkir prime = 0.4.0.beta.0 contains a cross-site request forgery vulnerability in its GraphQL endpoint that allows attackers to exploit GET-based query requests. Attackers can craft malicious GET requests to trigger unauthorized actions against privileged users by manipulating GraphQL query...

@vltpkg/cli-sdk (>=1.0.0-rc.1, <=1.0.0-rc.9), @vltpkg/config (>=1.0.0-rc.1, <=1.0.0-rc.9) +8 more potentially affected by CVE-2026-24909 via @vltpkg/tar (>=1.0.0-rc.1, <=1.0.0-rc.9)

@vltpkg/tar NPM version =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.9 Source cves: CVE-2026-24909 Source advisory: OSV:GHSA-GF2C-JWCJ-X929...

@vltpkg/cli-sdk (>=1.0.0-rc.1, <=1.0.0-rc.9), @vltpkg/config (>=1.0.0-rc.1, <=1.0.0-rc.9) +8 more potentially affected by CVE-2026-24909 via @vltpkg/tar (>=1.0.0-rc.1, <=1.0.0-rc.9)

@vltpkg/tar NPM version =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.9 Source cves: CVE-2026-24909 Source advisory: GHSA-GF2C-JWCJ-X929...

@vltpkg/cli-sdk (>=1.0.0-rc.1, <=1.0.0-rc.9), @vltpkg/config (>=1.0.0-rc.1, <=1.0.0-rc.9) +8 more potentially affected by CVE-2026-24909 via @vltpkg/tar (>=1.0.0-rc.1, <=1.0.0-rc.9)

@vltpkg/tar NPM version =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.9 Source cves: CVE-2026-24909 Source advisory: SNYK:JS-VLTPKGTAR-15127281...