@directus/api vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-26185Mediumdirectus: Directus Vulnerable to User Enumeration via Password Reset Timing Attack CVE-2026-22032Mediumdirectus: Directus has open redirect in SAML CVE-2025-64749Mediumdirectus: Directus Vulnerable to Information Leakage in Existing Collections CVE-2025-64748Mediumdirectus: Directus's conceal fields are searchable if read permissions enabled CVE-2025-55746Criticaldirectus: Directus allows unauthenticated file upload and file modification due to lacking input sanitization CVE-2024-47822Medium@directus/api: Directus inserts access token from query string into logs CVE-2025-30351Lowdirectus: Suspended Directus user can continue to use session token to access API CVE-2025-27089Mediumdirectus: Directus allows updates to non-allowed fields due to overlapping policies CVE-2024-54151Highdirectus: Directus allows unauthenticated access to WebSocket events and operations CVE-2024-46990Mediumdirectus: Directus vulnerable to SSRF Loopback IP filter bypass CVE-2024-45596Highdirectus: Session is cached for OpenID and OAuth2 if `redirect` is not used CVE-2024-39699Medium@directus/api: Directus Blind SSRF On File Import

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo