directus vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-30350Medium@directus/storage-driver-s3: Directus's S3 assets become unavailable after a burst of HEAD requests CVE-2025-30225Medium@directus/storage-driver-s3: Directus's S3 assets become unavailable after a burst of malformed transformations CVE-2025-27089Mediumdirectus: Directus allows updates to non-allowed fields due to overlapping policies GHSA-9QRM-48QF-R2RWLowdirectus: Directus has a DOM-Based cross-site scripting (XSS) via layout_options CVE-2025-24353Mediumdirectus: Directus allows privilege escalation using Share feature CVE-2024-54151Highdirectus: Directus allows unauthenticated access to WebSocket events and operations CVE-2024-54128Medium@directus/app: Directus has an HTML Injection in Comment CVE-2024-46990Mediumdirectus: Directus vulnerable to SSRF Loopback IP filter bypass CVE-2024-45596Highdirectus: Session is cached for OpenID and OAuth2 if `redirect` is not used CVE-2024-6534Mediumdirectus: Directus has an insecure object reference via PATH presets CVE-2024-39896Highdirectus: Directus Allows Single Sign-On User Enumeration CVE-2024-39701Highdirectus: Directus incorrectly handles `_in` filter CVE-2024-36128Highdirectus: Directus is soft-locked by providing a string value to random string util CVE-2024-34709Mediumdirectus: Directus Lacks Session Tokens Invalidation CVE-2024-34708Mediumdirectus: Directus allows redacted data extraction on the API through "alias"CVE-2024-28239Mediumdirectus: URL Redirection to Untrusted Site in OAuth2/OpenID in directus CVE-2024-28238Lowdirectus: Session Token in URL in directus CVE-2024-27296Mediumdirectus: Directus version number disclosure CVE-2024-27295Highdirectus: Directus has MySQL accent insensitive email matching CVE-2023-45820Highdirectus: Directus crashes on invalid WebSocket message GHSA-22RR-F3P8-5GF8Highdirectus: Directus affected by VM2 sandbox escape vulnerability CVE-2023-38503Mediumdirectus: Incorrect Permission Checking for GraphQL Subscriptions CVE-2020-19850Mediumdirectus: Directus API vulnerable to denial of service CVE-2023-28443Mediumdirectus: directus vulnerable to Insertion of Sensitive Information into Log File CVE-2023-27481Mediumdirectus: Directus vulnerable to extraction of password hashes through export querying

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo