GHSA-3c5g-73f7-grvmHigh severity
← Search results
AUTOMATICALLY VERIFIEDOFFICIAL VENDOR SOURCECOLLECTED 23 SEP 2026
Neos · AUTOMATIC DISCOVERY
Neos Lifecycle policy
Neos is tracked by BlackTree as a server-side software product. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
This record passed BlackTree's automatic primary-source checks with a confidence score of 82. It is returned for operational research without requiring routine manual approval. Confirm edition and deployment applicability before acting.
This discovery does not establish a product-specific support or retirement date. A missing date does not mean support continues.
Product overview
Neos is tracked by BlackTree as a server-side software product. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
Main capabilities
- Networked or application service delivery
- Administrative and operational interfaces
- Versioned maintenance and security updates
Typical use
Used to provide application, infrastructure or operational services to other systems and users.
Deployment
Deployed on servers, virtual machines, containers or managed infrastructure.
This category-level context is generated from the registered product identity. Confirm exact product capabilities on the publisher's page .
Collected lifecycle data
| Product | Neos |
|---|---|
| Release | Lifecycle policy |
| Start or release | Not extracted |
| Lifecycle boundary | Continuous or not dated in the source |
| Date precision | Unknown |
Known exploited vulnerabilities
Catalogue updated 1 Oct 2026These are product-family matches in the CISA Known Exploited Vulnerabilities catalogue. Confirm the affected product version in the vendor advisory.
No CISA known-exploited entries currently match this mapped product family.
This does not mean the product has no vulnerabilities.
Package vulnerability advisories
Checked 1 Oct 2026OSV advisories are matched through the registered package URL. A package-family match does not prove that the installed release is affected. Check the affected and fixed versions before remediation.
GHSA-6cj3-rc4p-f38fHigh severity
Cross-site Scripting vulnerabilities in Neos
OSV recordGHSA-jfxf-4frr-9j3qMedium severity
XSS in various backend modules due to (un)escaping in JS notification module
OSV recordGHSA-43cf-7f3h-38rgMedium severity
Privilege Escalation in TYPO3 Neos
OSV recordCVE-2022-30429Medium severity
Neos CMS vulnerable to XSS in various backend modules
OSV recordSource evidence
PRIMARYManual
Neos official lifecycle source
Each Long Term Support (LTS) version receives bug fixes for 2 years and security fixes for 1 additional year (3 in total) | This results in a simple and predictable scheme. In the (unlikely) event of no breaking changes being present, no major version is released, minor versions are released instead. In such a case a minor release will be declared as LTS, making sure the flow of LTS releases stays intact. | Breaking the Rules | This policy will be followed on a best-effort basis. In extreme cases it may not be possible to support a release for the planned lifetime; for example if a serious bug is found that cannot be resolved in a given major version without significant risk to the stability of the code or loss of compatibility. In such cases, early retirement of a version may be required. | The Release Cycle | A Release Manager is responsible for a release branch that includes a specific new release and all of its bugfix releases (i.e. The Release Manager for 8.0 is responsible for 8.0.1, but not 8.1.x). The Release Manager is responsible, throughout the maintenance lifetime of their specific release branch, for the following things: | Schedule and coordinate contributions for a specific release branch and all of its bugfix releases.
Publisher identity used by product-specific official-source collectors.
Open official vendor source