CVE-2025-10193 Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend...

CVE-2025-10193 Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend...

CVE-2025-10193 Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend...

PT-2025-37184

Name of the Vulnerable Software and Affected Versions: Neo4j Cypher MCP server affected versions not specified Description: A DNS rebinding issue exists in the Neo4j Cypher MCP server. This allows malicious websites to circumvent Same-Origin Policy protections and execute unauthorized tool...

Neo4j MCP Clients & Servers 安全漏洞

Neo4j MCP Clients & Servers is a protocol for managing large language model contexts in the Neo4j Contrib open source. A security vulnerability exists in Neo4j MCP Clients & Servers, which stems from a DNS rebinding vulnerability that could lead to bypassing same-origin policy protections and...

CVE-2025-56406

An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication is not mandatory for MCP servers, and the mcp-neo4j MCP server is only intended for use in a local...

CVE-2025-56406

An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication is not mandatory for MCP servers, and the mcp-neo4j MCP server is only intended for use in a local...

CVE-2025-56406

An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication is not mandatory for MCP servers, and the mcp-neo4j MCP server is only intended for use in a local...

Neo4j MCP Clients & Servers 安全漏洞

Neo4j MCP Clients & Servers is a Neo4j Contrib open source protocol for managing large language model contexts. A security vulnerability exists in Neo4j MCP Clients & Servers version 0.3.0, which originates in the SSE service and could lead to the disclosure of sensitive information or the...

CVE-2025-56406

An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication is not mandatory for MCP servers, and the mcp-neo4j MCP server is only intended for use in a local...

PT-2025-37048

Name of the Vulnerable Software and Affected Versions: mcp-neo4j version 0.3.0 Description: An issue was discovered that allows attackers to gain sensitive information or execute arbitrary commands via the SSE service. Recommendations: At the moment, there is no information about a newer version...

CVE-2025-58056 vulnerabilities

Vulnerabilities for packages: flyway, seata, sonarqube, spark-fips, apache-activemq-artemis, infinispan, tez, wavefront-proxy, akhq, strimzi-kafka-operator, knative-kafka-broker, keycloak, trino, apicurio-registry, thingsboard, kayenta, neo4j, kserve-modelmesh, kayenta-fips, apache-hop,...

GHSA-FGHV-69VJ-QJ49 vulnerabilities

Vulnerabilities for packages: flyway, seata, sonarqube, spark-fips, apache-activemq-artemis, infinispan, tez, wavefront-proxy, akhq, strimzi-kafka-operator, knative-kafka-broker, keycloak, trino, apicurio-registry, thingsboard, kayenta, neo4j, kserve-modelmesh, kayenta-fips, apache-hop,...

CVE-2025-55163 vulnerabilities

Vulnerabilities for packages: flyway, seata, sonarqube, spark-fips, infinispan, tez, akhq, strimzi-kafka-operator, knative-kafka-broker, keycloak, trino, apicurio-registry, thingsboard, kserve-modelmesh, apache-hop, management-api-for-apache-cassandra-4.1, elasticsearch-fips, camunda-zeebe,...

GHSA-PRJ3-CCX8-P6X4 vulnerabilities

Vulnerabilities for packages: flyway, seata, sonarqube, spark-fips, infinispan, tez, akhq, strimzi-kafka-operator, knative-kafka-broker, keycloak, trino, apicurio-registry, thingsboard, kserve-modelmesh, apache-hop, management-api-for-apache-cassandra-4.1, elasticsearch-fips, camunda-zeebe,...

CVE-2025-48924 vulnerabilities

Vulnerabilities for packages: flyway, sonarqube, kafka, sonar-scanner-cli, zaproxy, commercial-elasticsearch, leiningen, spark-fips, apache-activemq-artemis, nrjmx, infinispan, solr, cassandra-reaper, akhq, keycloak, apache-tika, apicurio-registry, jenkins-plugin-manager, nextflow, thingsboard,...

GHSA-J288-Q9X7-2F5V vulnerabilities

Vulnerabilities for packages: flyway, sonarqube, kafka, sonar-scanner-cli, zaproxy, commercial-elasticsearch, leiningen, spark-fips, apache-activemq-artemis, nrjmx, infinispan, solr, cassandra-reaper, akhq, keycloak, apache-tika, apicurio-registry, jenkins-plugin-manager, nextflow, thingsboard,...

CVE-2025-48734 vulnerabilities

Vulnerabilities for packages: sonarqube, kafka, apache-activemq-artemis, tez, cassandra-reaper, akhq, strimzi-kafka-operator, trino, apicurio-registry, jenkins-plugin-manager, neo4j, camunda-zeebe, confluent-kafka-jre-bcfips, ghidra, confluent-common-docker, celeborn, apache-nifi,...

CVE-2023-23926

APOC Awesome Procedures on Cypher is an add-on library for Neo4j. An XML External Entity XXE vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 4.4 branch in Neo4j graph database. XML External Entity XXE injection occurs when the XML...

CVE-2021-42767

A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1...