keystonejs keystone

Name: keystonejs keystone
Brand: keystonejs

productUS

cpe:2.3:a:keystonejs:keystone:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

3critical3high7medium0low

updated 2026-10-28

vulnerabilities (13)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-15879US	high8.8	7.22% (94th)	Exploit	no fix	2017-10-24	≤ 4.0.0
CVE-2017-15878US	medium6.1	3.42% (89th)	Exploit	4.0.0	2017-10-24	< 4.0.0
CVE-2017-16570US	high8.8	2.21% (83rd)	Exploit	4.0.0	2017-11-06	< 4.0.0
CVE-2022-0087US	medium6.1	2.60% (85th)	—	1.0.2	2022-01-12	< 1.0.2
CVE-2022-29354US	critical9.8	2.60% (85th)	—	no fix	2022-05-16	= 4.2.1
CVE-2022-39382US	critical9.8	1.65% (76th)	—	no fix	2022-11-03	2 versions
CVE-2022-39322US	critical9.8OT elevated	1.46% (73rd)	—	2.3.1	2022-10-25	2.2.0 → 2.3.1
CVE-2017-15881US	medium4.8	1.21% (68th)	—	no fix	2017-10-24	2 versions
CVE-2015-9240US	high7.5	0.88% (59th)	—	0.3.16	2018-05-29	< 0.3.16
CVE-2023-40027US	medium5.3OT elevated	0.58% (47th)	—	5.5.1	2023-08-15	< 5.5.1
CVE-2023-34247US	medium4.1	0.41% (35th)	—	no fix	2023-06-13	≤ 7.0.0
CVE-2025-46720US	medium4.3	0.28% (21st)	—	6.5.0	2025-05-05	< 6.5.0
CVE-2026-33326US	medium4.3OT elevated	0.27% (19th)	—	6.5.2	2026-03-24	< 6.5.2

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-863Incorrect Authorization2 CVEs
CWE-1255Comparison Logic is Vulnerable to Power Side-Channel Attacks1 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-203Observable Discrepancy1 CVEs
CWE-255CWE-2551 CVEs
CWE-285Improper Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.