Kkeystonejs

Products

Exploited and recent CVEs

• CVE-2026-63421 High 7.5 Keystone: `graphql.maxTake` bypass with negative `take` 0.7%
• CVE-2026-10802 Medium 4.3 keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption 0.3%
• CVE-2026-33326 Medium 4.3 @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany 0.3%
• CVE-2025-46720 Low 3.1 Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields 0.3%
• CVE-2023-40027 Low 3.7 Conditionally missing authorization in @keystone-6/core 0.6%
• CVE-2023-34247 Medium 6.1 @keystone-6/auth Open Redirect vulnerability 0.4%
• CVE-2022-39382 Critical 9.8 NODE_ENV in Keystone defaults to development with esbuild 2.1%
• CVE-2022-39322 Critical 9.1 @keystone-6/core vulnerable to field-level access-control bypass for multiselect field 1.5%
• CVE-2022-0087 High 7.1 Cross-site Scripting (XSS) - Reflected in keystonejs/keystone 2.8%
• CVE-2021-32624 High 7.5 Private Field data leak 0.9%