Neo4j 安全漏洞

Neo4j is a Java-based graph database developed by the American company Neo4j, and it is fully compatible with ACID standards. It supports data migration and add-ons. Versions of Neo4j Enterprise prior to 2026.01.4 contained security vulnerabilities. These vulnerabilities stemmed from excessive...

CVE-2026-1471: Incorrect Authorization

Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO UserInfo endpoint. We...

PT-2026-24715

Name of the Vulnerable Software and Affected Versions Neo4j Enterprise edition versions prior to 2026.02 Neo4j Enterprise edition versions prior to 5.26.22 Description An incorrect resolution of namespaces in composite databases in Neo4j Enterprise edition can lead to a scenario where an...

Neo4j Enterprise Edition 安全漏洞

Neo4j Enterprise Edition is a graph database developed by the American company Neo4j. Versions prior to 2026.02 and 5.26.22 contained security vulnerabilities. These vulnerabilities were caused by errors in namespace resolution within composite databases, which could potentially allow...

This Week in Spring - March 10th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring. As I write this, I am preparing for a trip to Rust, Germany, for one of the best Java conferences in Europe: JavaLand, along with its new companion event, DevLand. It should be fun. Will you be around? If so, say hi. We have ...

A Bootiful Podcast: Neo4j legend Jennifer Reif

Hi, Spring fans! In this installment, I talk to Jennifer Reif, developer advocate at Neo4J, about graph RAG, graph databases, GraphQL, Neo4J, Spring Data Neo4J, and more. neo4j graphRag AI artificialintelligence...

multi-agent-attack-graph-poc

🛡️ Security Investigation System This is a Proof of Concept...

BIT-NEO4J-2026-1337 Insufficient escaping of unicode characters in query log

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat...

This Week in Spring - February 24th, 2026

Hi, Spring fans! Welcome to another awesome and oh-so-agentic week in Spring! We've got a ton to look into, and I've got even more to prepare for next week's DevNexus event in Atlanta, GA, so let's dive right into it! Be sure to say "hi" if you're going to be there, though! You've heard of Agent...

Neo4j < 5.26.21 Information Disclosure Vulnerability (CVE-2026-1622)

According to its self-reported version number, the version of Neo4j running on the remote host is a version prior to 5.26.21. It is, therefore, affected by a information disclosure vulnerability where The obfuscateliterals option in the query logs does not redact error information, exposing...

Neo4j < 2026.01 XSS Vulnerability (CVE-2026-1337)

According to its its self-reported version number, the version of Neo4j running on the remote host is a version prior to 2026.01. It is, therefore, affected by a XSS vulnerability where Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions. Note that...

CVE-2026-1337

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat...

CVE-2026-1622 vulnerabilities

Vulnerabilities for packages: neo4j...

GHSA-4J3G-RWWQ-4P54 vulnerabilities

Vulnerabilities for packages: neo4j...

GHSA-4J3G-RWWQ-4P54 vulnerabilities

Vulnerabilities for packages: neo4j...

CVE-2026-1622 vulnerabilities

Vulnerabilities for packages: neo4j...

CVE-2026-1622

A flaw was found in Neo4j. The obfuscateliterals option in the query logs fails to extend redaction to error messages. When a query triggers an error, unredacted data, potentially containing sensitive literals, are exposed in the logs. This issue allows an attacker with access to the local log...

Improper Output Neutralization for Logs

Overview org.neo4j:neo4j is a Neo4j is a graph database management system developed by Neo4j, Inc. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs due to insufficient escaping of unicode characters in query.log output. A user can inject a malicious log...

GHSA-XR72-G735-4VWP Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat...

Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat...