Advisories · Technology
@neo4j/graphql.
Every CVE that names @neo4j/graphql among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.3 CriticalCritical · CVSS 9+
@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields
- @neo4j/graphql
- Authentication bypass
- CVSS 8.6 High
@neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier
- @neo4j/graphql
- Broken access control
- CVSS 7.6 High
Privilege Escalation via Dropped Field-Level @authentication
- neo4j graphql
- Broken access control
- CVSS 8.2 High
Subscription Authentication Bypass via Unverified connectionParams.jwt
- neo4j graphql
- CWE-302