directus vulnerabilities
61 published CVEs name directus among the affected products.
- 61Published CVEs61 of them scored
- 16Last 12 monthspublished in the last year
- 2Critical16 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-126539
Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
directus · directus
Critical9.2 - CVE-2026-10716
Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation
Directus · Directus
High7.5 - CVE-2026-61836
Directus: Authorization-dependent response served from unsegmented cache key
directus · directus
High8.6 - CVE-2026-61835
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
directus · directus
High7.7 - CVE-2026-39943
Directus exposes sensitive fields in revision history
directus · directus
Medium6.5 - CVE-2026-39942
Directus has a Path Traversal and Broken Access Control in File Management API
directus · directus
High8.5 - CVE-2026-35442
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
directus · directus
High8.1 - CVE-2026-35441
Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits
directus · directus
Medium6.5 - CVE-2026-35413
Directus GraphQL Schema SDL Disclosure Setting
directus · directus
Medium5.3 - CVE-2026-35412
Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
directus · directus
High7.1