# Neo4j vulnerabilities Source: https://junglewise.ai/threats/vendors/neo4j Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/neo4j.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 8 vulnerabilities in Neo4j: 2 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-92684, was published on 10 November 2026. 2 vulnerabilities in the last four weeks, up from none in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 2 - Last 30 days: 2 - Last 90 days: 4 - All time: 8 (0 critical, 0 exploited in the wild) ## About Neo4j A graph database company that develops the Neo4j graph data platform. ## Latest Neo4j vulnerabilities - [CVE-2026-92684: Neo4j @neo4j/graphql authentication bypass in aggregation queries](https://junglewise.ai/threats/cve-2026-92684-missing-authentication-for-critical-function-in-aggregation) (info, published 10 Nov 2026) - [CVE-2026-92683: Neo4j @neo4j/graphql authorization bypass in @authentication JWT filter](https://junglewise.ai/threats/cve-2026-92683-incorrect-authorization-in-the-authentication-directive-jwt-where) (info, published 9 Nov 2026) - [CVE-2026-92682: Neo4j GraphQL authorization filter logic inversion on relationships](https://junglewise.ai/threats/cve-2026-92682-in-neo4j-graphql-versions-from-7-0-0-up-to-but-not-including-7-6) (info, published 12 Oct 2026) - [CVE-2026-92681: Neo4j GraphQL authentication bypass in @cypher fields](https://junglewise.ai/threats/cve-2026-92681-in-neo4j-graphql-versions-up-to-and-including-7-6-3) (info, published 12 Oct 2026) - [CVE-2026-5423: @neo4j/graphql subscription authentication bypass via unverified JWT](https://junglewise.ai/threats/cve-2026-5423-neo4j-graphql-subscription-authentication-bypass-via-unverified) (info, CVSS 8.2, published 6 Aug 2026) - [CVE-2026-1524: Neo4j Enterprise Edition incorrect authorization in SSO implementation](https://junglewise.ai/threats/cve-2026-1524-neo4j-enterprise-edition-incorrect-authorization-in-sso) (info, CVSS 9.8, published 11 Mar 2026) - [CVE-2026-1471: Neo4j Enterprise Edition incorrect authorization in SSO authentication context](https://junglewise.ai/threats/cve-2026-1471-neo4j-enterprise-edition-incorrect-authorization-in-sso) (info, CVSS 6.5, published 11 Mar 2026) - [CVE-2026-1337: Neo4j Enterprise and Community log injection via unescaped metadata](https://junglewise.ai/threats/cve-2026-1337-neo4j-enterprise-and-community-log-injection-via-unescaped) (medium, CVSS 5.4, published 6 Feb 2026) ## Most severe Neo4j vulnerabilities - [CVE-2026-1337: Neo4j Enterprise and Community log injection via unescaped metadata](https://junglewise.ai/threats/cve-2026-1337-neo4j-enterprise-and-community-log-injection-via-unescaped) (medium, CVSS 5.4, published 6 Feb 2026) - [CVE-2026-1524: Neo4j Enterprise Edition incorrect authorization in SSO implementation](https://junglewise.ai/threats/cve-2026-1524-neo4j-enterprise-edition-incorrect-authorization-in-sso) (info, CVSS 9.8, published 11 Mar 2026) - [CVE-2026-5423: @neo4j/graphql subscription authentication bypass via unverified JWT](https://junglewise.ai/threats/cve-2026-5423-neo4j-graphql-subscription-authentication-bypass-via-unverified) (info, CVSS 8.2, published 6 Aug 2026) - [CVE-2026-1471: Neo4j Enterprise Edition incorrect authorization in SSO authentication context](https://junglewise.ai/threats/cve-2026-1471-neo4j-enterprise-edition-incorrect-authorization-in-sso) (info, CVSS 6.5, published 11 Mar 2026) - [CVE-2026-92681: Neo4j GraphQL authentication bypass in @cypher fields](https://junglewise.ai/threats/cve-2026-92681-in-neo4j-graphql-versions-up-to-and-including-7-6-3) (info, published 12 Oct 2026) - [CVE-2026-92682: Neo4j GraphQL authorization filter logic inversion on relationships](https://junglewise.ai/threats/cve-2026-92682-in-neo4j-graphql-versions-from-7-0-0-up-to-but-not-including-7-6) (info, published 12 Oct 2026) - [CVE-2026-92684: Neo4j @neo4j/graphql authentication bypass in aggregation queries](https://junglewise.ai/threats/cve-2026-92684-missing-authentication-for-critical-function-in-aggregation) (info, published 10 Nov 2026) - [CVE-2026-92683: Neo4j @neo4j/graphql authorization bypass in @authentication JWT filter](https://junglewise.ai/threats/cve-2026-92683-incorrect-authorization-in-the-authentication-directive-jwt-where) (info, published 9 Nov 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## Neo4j technologies - [Neo4j @Neo4j/Graphql](https://junglewise.ai/threats/technologies/neo4j-graphql): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Neo4j vulnerabilities", https://junglewise.ai/threats/vendors/neo4j, 12 November 2026.