Monospace / Directus
56 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-61836 | Directus: Authorization-dependent response served from unsegmented cache key | HIGH | 8.6 | Jul 15, 2026 |
| CVE-2026-61835 | Directus: SSRF Protection Bypass via 0.0.0.0 in File Import | HIGH | 7.7 | Jul 15, 2026 |
| CVE-2026-39943 | Directus exposes sensitive fields in revision history | MEDIUM | 6.5 | Apr 9, 2026 |
| CVE-2026-39942 | Directus has a Path Traversal and Broken Access Control in File Management API | HIGH | 8.8 | Apr 9, 2026 |
| CVE-2026-35442 | Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries | HIGH | 8.1 | Apr 6, 2026 |
| CVE-2026-35441 | Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits | MEDIUM | 6.5 | Apr 6, 2026 |
| CVE-2026-35413 | Directus GraphQL Schema SDL Disclosure Setting | MEDIUM | 5.3 | Apr 6, 2026 |
| CVE-2026-35412 | Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite | HIGH | 8.1 | Apr 6, 2026 |
| CVE-2026-35411 | Directus is an Open Redirect in Admin 2FA Setup Page | MEDIUM | 4.3 | Apr 6, 2026 |
| CVE-2026-35410 | Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow | MEDIUM | 6.1 | Apr 6, 2026 |
| CVE-2026-35409 | Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import | HIGH | 7.7 | Apr 6, 2026 |
| CVE-2026-35408 | Directus is Missing Cross-Origin Opener Policy | CRITICAL | 9.3 | Apr 6, 2026 |
| CVE-2026-26185 | Directus Affected by User Enumeration via Password Reset Timing Attack | MEDIUM | 5.3 | Feb 12, 2026 |
| CVE-2026-22032 | Directus has open redirect in SAML | MEDIUM | 6.1 | Jan 8, 2026 |
| CVE-2025-64749 | Directus Vulnerable to Information Leakage in Existing Collections | MEDIUM | 4.3 | Nov 13, 2025 |
| CVE-2025-64748 | Directus's conceal fields are searchable if read permissions enabled | MEDIUM | 6.5 | Nov 13, 2025 |
| CVE-2025-64747 | Directus Vulnerable to Stored Cross-site Scripting | MEDIUM | 5.5 | Nov 13, 2025 |
| CVE-2025-64746 | Directus has Improper Permission Handling on Deleted Fields | MEDIUM | 5.4 | Nov 13, 2025 |
| CVE-2025-55746 | Directus allows unauthenticated file upload and file modification due to lacking input sanitization | CRITICAL | 9.3 | Aug 20, 2025 |
| CVE-2025-53889 | Directus missing permission checks for manual trigger Flows | MEDIUM | 6.5 | Jul 14, 2025 |
| CVE-2025-53887 | Directus's exact version number is exposed by the OpenAPI Spec | MEDIUM | 5.3 | Jul 14, 2025 |
| CVE-2025-53886 | Directus doesn't redact tokens in Flow logs | MEDIUM | 4.5 | Jul 14, 2025 |
| CVE-2025-53885 | Directus doesn't redact sensitive user data when logging via event hooks | MEDIUM | 4.2 | Jul 14, 2025 |
| CVE-2025-30353 | Directus's webhook trigger flows can leak sensitive data | HIGH | 8.6 | Mar 26, 2025 |
| CVE-2025-30352 | Directus `search` query parameter allows enumeration of non permitted fields | MEDIUM | 5.3 | Mar 26, 2025 |
Showing 1 to 25 of 56 CVEs