NEO4J @neo4j/graphql vulnerabilities

2 CVEs affecting NEO4J @neo4j/graphql, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-92682, published 2026-10-12.

More from NEO4J.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-92681, published 2026-10-12. Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days. In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with…
• CVE-2026-92682, published 2026-10-12. High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days. In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it…