keystonejs vulnerabilities
10 published CVEs name keystonejs among the affected products.
- 10Published CVEs10 of them scored
- 3Last 12 monthspublished in the last year
- 2Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-63421
Keystone: `graphql.maxTake` bypass with negative `take`
keystonejs · keystone
High7.5 - CVE-2026-10802
keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption
keystonejs · keystone
Medium5.3 - CVE-2026-33326
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany
keystonejs · keystone
Medium4.3 - CVE-2025-46720
Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields
keystonejs · keystone
Low3.1 - CVE-2023-40027
Conditionally missing authorization in @keystone-6/core
keystonejs · keystone
Low3.7 - CVE-2023-34247
@keystone-6/auth Open Redirect vulnerability
keystonejs · keystone
Medium6.1 - CVE-2022-39382
NODE_ENV in Keystone defaults to development with esbuild
keystonejs · keystone
Critical9.8 - CVE-2022-39322
@keystone-6/core vulnerable to field-level access-control bypass for multiselect field
keystonejs · keystone
Critical9.1 - CVE-2022-0087
Cross-site Scripting (XSS) - Reflected in keystonejs/keystone
keystonejs · keystonejs/keystone
High7.1 - CVE-2021-32624
Private Field data leak
keystonejs · keystone-5
High7.5