CVE-2026-61836 | High | 8.6 | 2026-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in… |
CVE-2026-61835 | High | 7.7 | 2026-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL featur… |
CVE-2026-39943 | Medium | 6.5 | 2026-04-09 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whe… |
CVE-2026-39942 | High | 8.5 | 2026-04-09 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled fil… |
CVE-2026-35442 | High | 8.1 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the co… |
CVE-2026-35441 | Medium | 6.5 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus' GraphQL endpoints (/graphql and /graphql/system) d… |
CVE-2026-35413 | Medium | 5.3 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQL_INTROSPECTION=false is configured, Directus cor… |
CVE-2026-35412 | High | 7.1 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows… |
CVE-2026-35411 | Medium | 4.3 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect… |
CVE-2026-35410 | Medium | 6.1 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirecti… |
CVE-2026-35409 | High | 7.7 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery (SSRF) protection bypass has b… |
CVE-2026-35408 | High | 8.7 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-O… |
CVE-2026-26185 | Medium | 5.3 | 2026-02-12 | Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the pa… |
CVE-2026-22032 | Medium | 4.3 | 2026-01-08 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directu… |
CVE-2025-64749 | Medium | 4.3 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API… |
CVE-2025-64748 | Medium | 6.5 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to sea… |
CVE-2025-64747 | Medium | 5.5 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vulnerability exists in versions prior to… |
CVE-2025-64746 | Medium | 4.6 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does not properly clean up field-level perm… |
CVE-2025-55746 | Critical | 9.3 | 2025-08-20 | Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechan… |
CVE-2025-53889 | Medium | 6.5 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a… |
CVE-2025-53887 | Medium | 5.3 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus vers… |
CVE-2025-53886 | Medium | 4.5 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flo… |
CVE-2025-53885 | Medium | 4.2 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flo… |
CVE-2025-30353 | High | 8.6 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "… |
CVE-2025-30352 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the `search` qu… |
CVE-2025-30351 | Low | 3.5 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can… |
CVE-2025-30350 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior… |
CVE-2025-30225 | Medium | 5.3 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior… |
CVE-2025-27089 | Medium | 5.4 | 2025-02-19 | Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the `update` ac… |
CVE-2025-24353 | Medium | 5.0 | 2025-01-23 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an a… |
CVE-2024-54151 | High | 7.5 | 2024-12-09 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKE… |
CVE-2024-54128 | Medium | 5.7 | 2024-12-05 | Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding rest… |
CVE-2024-47822 | Medium | 4.2 | 2024-10-08 | Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed… |
CVE-2024-46990 | Medium | 5.0 | 2024-09-18 | Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filte… |
CVE-2024-45596 | High | 7.4 | 2024-09-10 | Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via… |
CVE-2024-6534 | Medium | 4.3 | 2024-08-15 | Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because… |
CVE-2024-6533 | Medium | 5.4 | 2024-08-15 | Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an… |
CVE-2024-39896 | High | 7.5 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can… |
CVE-2024-39895 | Medium | 6.5 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of… |
CVE-2024-39701 | Medium | 6.3 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evalua… |
CVE-2024-39699 | Medium | 5.0 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed… |
CVE-2024-36128 | High | 7.5 | 2024-06-03 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string ge… |
CVE-2024-34709 | Medium | 5.4 | 2024-05-14 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they… |
CVE-2024-34708 | Medium | 4.9 | 2024-05-14 | Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacted hashed fields can… |
CVE-2024-28239 | Medium | 5.4 | 2024-03-12 | Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an… |
CVE-2024-28238 | Low | 2.3 | 2024-03-12 | Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of s… |
CVE-2024-27296 | Medium | 5.3 | 2024-03-01 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped i… |
CVE-2024-27295 | High | 8.2 | 2024-03-01 | Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to recei… |
CVE-2023-45820 | Medium | 5.9 | 2023-10-19 | Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can… |
CVE-2023-38503 | Medium | 5.7 | 2023-07-25 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters… |
CVE-2020-19850 | Medium | 6.5 | 2023-04-04 | An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests. |
CVE-2023-28443 | Medium | 4.2 | 2023-03-24 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly… |
CVE-2023-27481 | Medium | 4.3 | 2023-03-07 | Directus is a real-time API and App dashboard for managing SQL database content. In versions prior to 9.16.0 users with read access to the `password` field in… |
CVE-2023-26492 | Medium | 5.0 | 2023-03-03 | Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a… |
CVE-2022-26969 | Critical | 9.8 | 2022-12-26 | In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. |
CVE-2022-36031 | Medium | 6.5 | 2022-08-19 | Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the `… |