https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:36:13 +0000 https://cve.radiocsirt.org/vuln/cnvd-2022-06896 cnvd-2022-06896 https://cve.radiocsirt.org/vuln/cnvd-2022-06896 https://cve.radiocsirt.org/vuln/euvd-2026-10680 EUVD-2026-10680 https://cve.radiocsirt.org/vuln/euvd-2026-10680 https://cve.radiocsirt.org/vuln/fkie_cve-2022-0087 <p>keystone is vulnerable to Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;)</p> <p>keystone is vulnerable to Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;)</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-0087 https://cve.radiocsirt.org/vuln/ghsa-hrgx-7j6v-xj82 <p><strong>Affected:</strong> npm: @keystone-6/auth, npm: @keystone-next/auth</p> <p>This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the `@keystone-6/auth` package.</p> <p>#### Impact The vulnerability can impact users of the administration user interface when following an untrusted link to the `signin` or `init` page. This is a targeted attack and may present itself in the form of phishing and or chained in conjunction with some other vulnerability.</p> <p>## Vulnerability mitigation Please upgrade to `@keystone-6/auth &gt;= 1.0.2`, where this vulnerability has been closed. If you are using `@keystone-next/auth`, we **strongly** recommend you upgrade to `@keystone-6`.</p> <p>### Workarounds If for some reason you cannot upgrade the dependencies in software, you could alternatively</p> <p>- disable the administration user interface, or - if using a reverse-proxy, strip query parameters when accessing the administration interface</p> <p>### References https://owasp.org/www-community/attacks/xss/</p> <p>Thanks to Shivansh Khari (@Shivansh-Khari) for discovering and reporting this vulnerability</p> <p><strong>Affected:</strong> npm: @keystone-6/auth, npm: @keystone-next/auth</p> <p>This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the `@keystone-6/auth` package.</p> <p>#### Impact The vulnerability can impact users of the administration user interface when following an untrusted link to the `signin` or `init` page. This is a targeted attack and may present itself in the form of phishing and or chained in conjunction with some other vulnerability.</p> <p>## Vulnerability mitigation Please upgrade to `@keystone-6/auth &gt;= 1.0.2`, where this vulnerability has been closed. If you are using `@keystone-next/auth`, we **strongly** recommend you upgrade to `@keystone-6`.</p> <p>### Workarounds If for some reason you cannot upgrade the dependencies in software, you could alternatively</p> <p>- disable the administration user interface, or - if using a reverse-proxy, strip query parameters when accessing the administration interface</p> <p>### References https://owasp.org/www-community/attacks/xss/</p> <p>Thanks to Shivansh Khari (@Shivansh-Khari) for discovering and reporting this vulnerability</p> https://cve.radiocsirt.org/vuln/ghsa-hrgx-7j6v-xj82 https://cve.radiocsirt.org/vuln/gsd-2022-0087 gsd-2022-0087 https://cve.radiocsirt.org/vuln/gsd-2022-0087