CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

databases/neo4j4.4.48

High performance graph store and database

Maintainer
otis@FreeBSD.org
Packages
neo4j 4.4.48
Upstream
Higher version available: 2026.10.1
CPE
neo4j:neo4j from the port
WWW
https://neo4j.com
Links
cgit · VuXML

Unaddressed (4) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2026-14712.1published 2026-03-11

Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).  We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the …

CVE-2026-15242.1published 2026-03-11

An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those th…

CVE-2026-14972.0published 2026-03-11

Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario:  an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database …

CVE-2026-13371.1published 2026-02-06

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01. P…

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (35)

Juraj Lutter (otis) · 4.4.48
databases/neo4j: Update to 4.4.48
cdffabf415
Ronald Klop (ronald) · 4.4.44_3
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Ronald Klop (ronald) · 4.4.44_2
*/*: bump portrevision after java_default=21 update

PR:	272855
2baaf16375
Juraj Lutter (otis) · 4.4.44_1
databases/neo4j: Fix run-time

- Assign UID and GIT to neo4j (both 369)
- Instruct neo4j to run as neo4j user
- Move config directory to PREFIX/etc/neo4j
- Move certificates base directory to PREFIX/etc/neo4j/certificates
- Move data directory to /var/db/neo4j/data
- Move metrics directory to /var/db/neo4j/metrics
- Move import directory to /var/db/neo4j/import
- Fix rc.d script accordingly

Partially based on information from [1] and [2]

PR:		268526 [1]
PR:		228532 [2]

Sponsored by:	resulta.sk
882cb317da
Juraj Lutter (otis) · 4.4.44
databases/neo4j: Update to 4.4.44

- Update to 4.4.44
- Take maintainership

Release notes:	https://neo4j.com/release-notes/database/neo4j-4-4-44/
Sponsored by:	resulta.sk
2f046ee404
Muhammad Moinur Rahman (bofh) · 4.4.35
Mk/**java.mk: Convert bsd.java.mk to USES

The following features have been added or changed:
- Instead of USE_JAVA use USES=java. This defaults to
  USES=java:build,run if NO_BUILD is undefined. Else it defaults to
  USES=java:run
- Instead of USE_ANT=yes use USES=java:ant which also implies
  USES=java:build
- Instead of JAVA_BUILD=yes use USES=java:build. Does not imply run or
  extract
- Instead of JAVA_EXTRACT=yes use USES=java:extract does not imply
  build or run
- Instead of JAVA_RUN=yes use USES=java:run does not imply extract or
  build
- Instead of USE_JAVA=<version> use USES=java and JAVA_VERSION=<version>

Approved by: mat (portmgr), glewis
Differential Revision:  https://reviews.freebsd.org/D48201
0835676e36
Neel Chauhan (nc) · 4.4.35
databases/neo4j: Update to 4.4.35
5058ba501e
Wen Heping (wen) · 4.4.27
databases/neo4j: Update to 4.4.27

Reset maintainer
bad307f410
Wen Heping (wen) · 4.4.24
databases/neo4j: Update to 4.4.24
196ff3084e
Wen Heping (wen) · 4.4.22
databases/neo4j: Update to 4.4.22
e4318fee1d
Wen Heping (wen) · 4.4.21
databases/neo4j: Update to 4.4.21
852ccdb4dc
Wen Heping (wen) · 4.4.16
databases/neo4j: Update to 4.4.16

set NEO4J_CONF correctly
aced8aab01
Wen Heping (wen) · 4.4.15
databases/neo4j: Update to 4.4.15
393c9637b9
Wen Heping (wen) · 4.4.14
databases/neo4j: Update to 4.4.14
db031c77f8
Wen Heping (wen) · 4.4.11
databases/neo4j: Update to 4.4.11
881fd3c9ce
Stefan Eßer (se) · 4.4.10
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 4.4.10
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Wen Heping (wen) · 4.4.10
databases/neo4j: Update to 4.4.10
ac893c2619
Wen Heping (wen) · 4.4.8
databases/neo4j: Update to 4.4.8
e9609b0580
Wen Heping (wen) · 4.4.7
databases/neo4j: Update to 4.4.7
9f549708bd
Wen Heping (wen) · 4.2.16
databases/neo4j: Update to 4.2.16

Take maintainership
PR:		263555
Reported by:	wen@
Approved by:	maintainer(timeout, > 14 days)
b6d4dd828b
Wen Heping (wen) · 3.5.31
databases/neo4j: Update to 3.5.31

PR:		262459
Reported by:	wen@
Approved by:	maintainer(timeout, >30 days)
8820f44efe
Bernhard Froehlich (decke) · 3.5.28
databases/neo4j: Add CPE information

Approved by:    portmgr (blanket)
62f30c9463
Wen Heping (wen) · 3.5.28
databases/neo4j: Update to 3.5.28

- Fix run error of cypher-shell
PR:		255103
Reported by:	wen@
Approved by:	maintainer(timeout, > 3 months)
4bddb1cdcd
Mathieu Arnold (mat) · 3.3.2
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 3.3.2
all: Remove all other $FreeBSD keywords.
135fdeebb9
Mathieu Arnold (mat) · 3.3.2
Remove # $FreeBSD$ from Makefiles.
305f148f48
Jonathan Anderson (jonathan) · 3.3.2
Update neo4j to v3.3.2.

While we're here, fix up some variable names to ensure that all of the
scripts work (e.g., /usr/local/etc/rc.d/neo4j).

Approved by:	crees
Differential Revision:	https://reviews.freebsd.org/D14260
63d67a6d68
Jonathan Anderson (jonathan) · 3.2.1_1
Update neo4j to v3.2.1.

Approved by:	crees
Differential Revision:	https://reviews.freebsd.org/D11446
56e01b03fc
Mathieu Arnold (mat) · 3.0.4_2
Remove svn keywords from patches.

Sponsored by:	Absolight
aa1ca03dda
Chris Rees (crees) · 3.0.4_2
Correct rc script path

Submitted by:	Radek Krejca
PR:		ports/216547
Submitted by:	Alistair Meney <atmeney@gmail.com>
bac5ce3736
Chris Rees (crees) · 3.0.4_1
Fix some more shebangs

Submitted by:	Amanda Strnad <amstrnad@gmail.com>
a7429f8e7b
Chris Rees (crees) · 3.0.4
Readd missed newline.
32f9d7bc83
Chris Rees (crees) · 3.0.4
Remove reference to internal variable.

No change in functionality.
6136de4b23
Chris Rees (crees) · 3.0.4
Neo4j is the world's leading Graph Database.  It is a high performance graph store with all the features expected of a mature and robust database, like a friendly query language and ACID transactions. The programmer works with a flexible network structure of nodes and relationships rather than static tables yet enjoys all the benefits of enterprise-quality database. For many applications, Neo4j of

WWW: https://neo4j.com
34f9c11fbb