396 matches found
CVE-2026-1497
Neo4j Enterprise suffers an incorrect namespace resolution in composite databases, before versions 2026.02 and 5.26.22. An admin granting access to a remote constituent "namespace.name" can inadvertently grant privileges to any local database or remote alias named "name"; if that target doesn’t e...
CVE-2026-1497
Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any...
CVE-2026-1497
Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any...
CVE-2026-1497 Incorrect privilege assignment in composite databases
Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any...
PT-2026-24726
Name of the Vulnerable Software and Affected Versions Neo4j Enterprise edition versions prior to 2026.01.4 Description Excessive caching of authentication context in Neo4j Enterprise edition allows authenticated users to inherit the context of the first user who authenticated after a restart. Thi...
Neo4j 安全漏洞
Neo4j is a Java-based graph database developed by the American company Neo4j, and it is fully compatible with ACID standards. It supports data migration and add-ons. Versions of Neo4j Enterprise prior to 2026.01.4 contained security vulnerabilities. These vulnerabilities stemmed from excessive...
PT-2026-24727
Name of the Vulnerable Software and Affected Versions Neo4j Enterprise edition versions prior to 2026.02 Neo4j Enterprise edition versions prior to 5.26.22 Description An issue in the Single Sign-On SSO implementation in Neo4j Enterprise edition can lead to unauthorized access. This occurs when a...
Neo4j Enterprise Edition 安全漏洞
Neo4j Enterprise Edition is a graph database developed by the American company Neo4j. Versions prior to 2026.02 and 5.26.22 of Neo4j Enterprise Edition contained security vulnerabilities. These vulnerabilities stemmed from edge cases in the SSO implementation, which could lead to unauthorized...
Neo4j Enterprise Edition 安全漏洞
Neo4j Enterprise Edition is a graph database developed by the American company Neo4j. Versions prior to 2026.02 and 5.26.22 contained security vulnerabilities. These vulnerabilities were caused by errors in namespace resolution within composite databases, which could potentially allow...
PT-2026-24715
Name of the Vulnerable Software and Affected Versions Neo4j Enterprise edition versions prior to 2026.02 Neo4j Enterprise edition versions prior to 5.26.22 Description An incorrect resolution of namespaces in composite databases in Neo4j Enterprise edition can lead to a scenario where an...
This Week in Spring - March 10th, 2026
Hi, Spring fans! Welcome to another installment of This Week in Spring. As I write this, I am preparing for a trip to Rust, Germany, for one of the best Java conferences in Europe: JavaLand, along with its new companion event, DevLand. It should be fun. Will you be around? If so, say hi. We have ...
A Bootiful Podcast: Neo4j legend Jennifer Reif
Hi, Spring fans! In this installment, I talk to Jennifer Reif, developer advocate at Neo4J, about graph RAG, graph databases, GraphQL, Neo4J, Spring Data Neo4J, and more. neo4j graphRag AI artificialintelligence...
multi-agent-attack-graph-poc
🛡️ Security Investigation System This is a Proof of Concept...
BIT-NEO4J-2026-1337 Insufficient escaping of unicode characters in query log
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat...
This Week in Spring - February 24th, 2026
Hi, Spring fans! Welcome to another awesome and oh-so-agentic week in Spring! We've got a ton to look into, and I've got even more to prepare for next week's DevNexus event in Atlanta, GA, so let's dive right into it! Be sure to say "hi" if you're going to be there, though! You've heard of Agent...
Neo4j < 2026.01 XSS Vulnerability (CVE-2026-1337)
According to its its self-reported version number, the version of Neo4j running on the remote host is a version prior to 2026.01. It is, therefore, affected by a XSS vulnerability where Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions. Note that...
Neo4j < 5.26.21 Information Disclosure Vulnerability (CVE-2026-1622)
According to its self-reported version number, the version of Neo4j running on the remote host is a version prior to 5.26.21. It is, therefore, affected by a information disclosure vulnerability where The obfuscateliterals option in the query logs does not redact error information, exposing...
CVE-2026-1337
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat...
