PT-2025-44600

Name of the Vulnerable Software and Affected Versions Neo4j versions prior to 2025-11602 Description A potential information leak exists in the bolt protocol handshake within Neo4j Enterprise and Community editions. This allows an attacker to obtain one byte of information from previous...

CVE-2025-11602: Sensitive Information in Resource Not Removed Before Reuse

Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses...

DNS Rebinding

Neo4j Cypher MCP is vulnerable to DNS Rebinding. The vulnerability is due to the MCP server trusting requests from rebinding hostnames, and attackers can lure users to a malicious website that rebinding succeeds on to bypass Same-Origin Policy and invoke tools against local Neo4j instances...

EUVD-2018-0819

Malware in sbrugna...

EUVD-2018-0611

Malware in sbrugna...

EUVD-2013-7037

Malware in sbrugna...

EUVD-2024-1703

Malicious code in bioql PyPI...

EUVD-2023-0344

Malicious code in bioql PyPI...

EUVD-2022-6501

Malicious code in bioql PyPI...

EUVD-2025-27549

Malicious code in bioql PyPI...

EUVD-2022-0817

Malicious code in bioql PyPI...

EUVD-2023-0647

Malicious code in bioql PyPI...

EUVD-2022-2059

Malicious code in bioql PyPI...

EUVD-2025-28908

Malicious code in bioql PyPI...

CVE-2025-10193

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend...

CVE-2025-56406

An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication is not mandatory for MCP servers, and the mcp-neo4j MCP server is only intended for use in a local...

Origin Validation Error

Overview mcp-neo4j-cypher is an A simple Neo4j MCP server Affected versions of this package are vulnerable to Origin Validation Error via the lack of proper origin validation in the server's request handling. An attacker can execute unauthorized tool invocations against locally running instances ...

GHSA-VCQX-V2MG-7CHX Neo4j Cypher MCP server is vulnerable to DNS rebinding

Impact DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spen...

Neo4j Cypher MCP server is vulnerable to DNS rebinding

Impact DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spen...

CVE-2025-10193

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend...