https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:09:44.959343+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2017-35665 cnvd-2017-35665 2026-10-03T09:09:45.023118+00:00 cnvd-2017-35665 https://cve.radiocsirt.org/vuln/euvd-2026-79037 EUVD-2026-79037 2026-10-03T09:09:45.023161+00:00 EUVD-2026-79037 https://cve.radiocsirt.org/vuln/fkie_cve-2017-16570 fkie_cve-2017-16570 2026-10-03T09:09:45.023182+00:00

KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.

 https://cve.radiocsirt.org/vuln/ghsa-q43c-g2g7-6gxj GHSA-q43c-g2g7-6gxj — Cross-Site Request Forgery (CSRF) in keystone 2026-10-03T09:09:45.023225+00:00

Affected: npm: keystone

Versions of `keystone` prior to 4.0.0 are vulnerable to Cross-Site Request Forgery (CSRF). The package fails to validate the presence of the `X-CSRF-Token` header, which may allow attackers to carry actions on behalf of other users on all endpoints.

## Recommendation

Update to version 4.0.0 or later.

 https://cve.radiocsirt.org/vuln/gsd-2017-16570 gsd-2017-16570 2026-10-03T09:09:45.023279+00:00 gsd-2017-16570