CVEs we hold for Directus
Records whose assigning authority named Directus as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-61836Directus: Authorization-dependent response served from unsegmented cache keydirectus CVE-2026-61835Directus: SSRF Protection Bypass via 0.0.0.0 in File Importdirectus CVE-2026-39943Directus exposes sensitive fields in revision historydirectus CVE-2026-39942Directus has a Path Traversal and Broken Access Control in File Management APIdirectus CVE-2026-35442Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queriesdirectus CVE-2026-35441Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limitsdirectus CVE-2026-35412Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwritedirectus CVE-2026-35411Directus is an Open Redirect in Admin 2FA Setup Pagedirectus CVE-2026-35410Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flowdirectus CVE-2026-35409Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Importdirectus CVE-2026-26185Directus Affected by User Enumeration via Password Reset Timing Attackdirectus; directus @directus/api CVE-2026-10716Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creationDirectus CVE-2025-64749Directus Vulnerable to Information Leakage in Existing Collectionsdirectus CVE-2025-64748Directus's conceal fields are searchable if read permissions enableddirectus CVE-2025-64747Directus Vulnerable to Stored Cross-site Scriptingdirectus CVE-2025-64746Directus has Improper Permission Handling on Deleted Fieldsdirectus CVE-2025-55746Directus allows unauthenticated file upload and file modification due to lacking input sanitizationdirectus CVE-2025-53889Directus missing permission checks for manual trigger Flowsdirectus CVE-2025-53887Directus's exact version number is exposed by the OpenAPI Specdirectus CVE-2025-53885Directus doesn't redact sensitive user data when logging via event hooksdirectus CVE-2025-30353Directus's webhook trigger flows can leak sensitive datadirectus CVE-2025-30352Directus `search` query parameter allows enumeration of non permitted fieldsdirectus CVE-2025-30351Suspended Directus user can continue to use session token to access APIdirectus CVE-2025-30350Directus's S3 assets become unavailable after a burst of HEAD requestsdirectus CVE-2025-30225Directus's S3 assets become unavailable after a burst of malformed transformationsdirectus CVE-2025-27089Overlapping policies allow update to non-allowed fields in directusdirectus CVE-2025-24353Directus privilege escalation vulnerability using Share featuredirectus CVE-2024-6534Directus 10.13.0 - Insecure object reference via PATH presetsDirectus CVE-2024-6533Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_optionsDirectus CVE-2024-54151Directus allows unauthenticated access to WebSocket events and operationsdirectus CVE-2024-47822Directus inserts access token from query string into logsdirectus CVE-2024-45596Directus's session is cached for OpenID and OAuth2 if `redirect` is not useddirectus CVE-2024-39895Directus GraphQL Field Duplication Denial of Service (DoS)directus CVE-2024-36128Directus is soft-locked by providing a string value to random string utildirectus CVE-2024-34708Directus allows redacted data extraction on the API through "alias"directus CVE-2024-28239URL Redirection to Untrusted Site in OAuth2/OpenID in directusdirectus CVE-2024-27295Directus MySQL accent insensitive email matchingdirectus CVE-2023-38503Directus has Incorrect Permission Checking for GraphQL Subscriptionsdirectus CVE-2023-28443directus vulnerable to Insertion of Sensitive Information into Log Filedirectus CVE-2023-27481Extract password hashes through export querying in directusdirectus CVE-2023-27474HTML Injection in Password Reset email to custom Reset URL in directusdirectus CVE-2023-26492Directus vulnerable to Server-Side Request Forgery On File Importdirectus CVE-2022-36031Unhandled exception on illegal filename_disk valuedirectus CVE-2022-23080directus - SSRF which leads to internal port scandirectus CVE-2022-22117Directus - Stored Cross-Site Scripting (XSS) in Profile Avatar Imagedirectus CVE-2022-22116Directus - Stored Cross-Site Scripting (XSS) via SVG File Uploaddirectus 60 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.