keystonejs keystone vulnerabilities
8 published CVEs name keystonejs keystone among the affected products.
- 8Published CVEs8 of them scored
- 3Last 12 monthspublished in the last year
- 2Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-63421
Keystone: `graphql.maxTake` bypass with negative `take`
keystonejs · keystone
High7.5 - CVE-2026-10802
keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption
keystonejs · keystone
Medium5.3 - CVE-2026-33326
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany
keystonejs · keystone
Medium4.3 - CVE-2025-46720
Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields
keystonejs · keystone
Low3.1 - CVE-2023-40027
Conditionally missing authorization in @keystone-6/core
keystonejs · keystone
Low3.7 - CVE-2023-34247
@keystone-6/auth Open Redirect vulnerability
keystonejs · keystone
Medium6.1 - CVE-2022-39382
NODE_ENV in Keystone defaults to development with esbuild
keystonejs · keystone
Critical9.8 - CVE-2022-39322
@keystone-6/core vulnerable to field-level access-control bypass for multiselect field
keystonejs · keystone
Critical9.1