Security and trust
Security advisories
When we fix a security vulnerability in a released version of our products, we publish an advisory here with what is affected, how severe it is and what to do.
Published advisories
There are no published advisories.
What an advisory contains
- an identifier in the form NI-SA-year-number, and a CVE identifier when one is assigned;
- the affected products and versions, and the version that fixes the issue;
- the severity, with its CVSS v4.0 vector;
- a description of the issue detailed enough to judge your exposure, without a working exploit;
- what to do: the upgrade, and any workaround until you can upgrade;
- credit to the reporter, if they want it.
An advisory is published once the fix is released and the disclosure date agreed with the reporter has arrived. When we learn more after publication, we update the advisory and its date.
Severity
We score each vulnerability with CVSS v4.0 and give the rating that goes with the score. The score describes the issue in our product; your own risk depends on how and where you run it.
| Rating | CVSS v4.0 score |
|---|---|
| Critical | 9.0 to 10.0 |
| High | 7.0 to 8.9 |
| Medium | 4.0 to 6.9 |
| Low | 0.1 to 3.9 |
How customers hear about them
We tell the security contact of each customer organisation about an advisory that affects them, no later than we publish it here. Self-hosted and air-gapped deployments receive no automatic updates from us, so your administrator decides when to install the fixed version. Each fixed version is listed in the release notes.
Supported versions
Security fixes are released for the latest version of each product. Upgrade promptly.
Report a vulnerability
Email security@neuralinverse.com. The vulnerability disclosure policy sets out what to include, our response times and our safe harbour for good-faith research.