Where
-Infinity
0

Trending

Last week
Last month
Last year

DirectusDirectus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation

Risk 66
Severity
7.5
First published (updated )
CVE-2026-10716

DirectusDirectus: SSRF Protection Bypass via 0.0.0.0 in File Import

Risk 44
Severity
7.7
First published (updated )
CVE-2026-61835

Directus DirectusDirectus privilege escalation vulnerability using Share feature

Risk 18
Severity
5
EPSS
0.04%
First published (updated )
CVE-2025-24353

npm/@directus/apiDirectus inserts access token from query string into logs

Risk 24
Severity
4.2
First published (updated )
CVE-2024-47822

npm/directusDirectus 10.13.0 - Insecure object reference via PATH presets

Risk 17
Severity
4.3
EPSS
0.04%
First published (updated )
CVE-2024-6534
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/directusDirectus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options

Risk 25
Severity
5.4
EPSS
0.04%
First published (updated )
CVE-2024-6533

npm/directusDirectus allows SSO User Enumeration

Risk 45
Severity
7.5
First published (updated )
CVE-2024-39896

npm/@directus/envDirectus GraphQL Field Duplication Denial of Service (DoS)

Risk 40
Severity
6.5
First published (updated )
CVE-2024-39895

npm/@directus/apiDirectus has a Blind SSRF On File Import

Risk 27
Severity
5
First published (updated )
CVE-2024-39699

npm/directusDirectus is soft-locked by providing a string value to random string util

Risk 45
Severity
7.5
First published (updated )
CVE-2024-36128
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/directusDirectus Lacks Session Tokens Invalidation

Risk 29
Severity
5.4
EPSS
0.04%
First published (updated )
CVE-2024-34709

npm/directusDirectus allows redacted data extraction on the API through "alias"

Risk 23
Severity
4.9
EPSS
0.04%
First published (updated )
CVE-2024-34708

npm/directusSession Token in URL in directus

Risk 10
Severity
2.3
EPSS
0.04%
First published (updated )
CVE-2024-28238

npm/directusURL Redirection to Untrusted Site in OAuth2/OpenID in directus

Risk 25
Severity
5.4
EPSS
0.04%
First published (updated )
CVE-2024-28239

npm/directusDirectus version number disclosure

Risk 20
Severity
5.3
EPSS
0.04%
First published (updated )
CVE-2024-27296
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/directusDirectus MySQL accent insensitive email matching

Risk 39
Severity
8.2
EPSS
0.04%
First published (updated )
CVE-2024-27295

npm/directusDirectus crashes on invalid WebSocket message

Risk 45
Severity
7.5
First published (updated )
CVE-2023-45820

npm/directusDirectus has Incorrect Permission Checking for GraphQL Subscriptions

Risk 39
Severity
6.5
First published (updated )
CVE-2023-38503

Monospace DirectusAn issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a g…

Risk 38
Severity
6.5
First published (updated )
CVE-2020-19850

Monospace Directus Node.jsdirectus vulnerable to Insertion of Sensitive Information into Log File

Risk 32
Severity
5.5
First published (updated )
CVE-2023-28443
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Monospace Directus Node.jsExtract password hashes through export querying in directus

Risk 22
Severity
4.3
First published (updated )
CVE-2023-27481

Monospace Directus Node.jsDirectus vulnerable to Server-Side Request Forgery On File Import

Risk 43
Severity
7.5
First published (updated )
CVE-2023-26492

Rangerstudio Directusdirectus - SSRF which leads to internal port scan

Risk 26
Severity
5
First published (updated )
CVE-2022-23080

Monospace DirectusIn Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.

Risk 86
Severity
9.8
First published (updated )
CVE-2022-26969

Rangerstudio DirectusDirectus - Stored Cross-Site Scripting (XSS) in Profile Avatar Image

Risk 34
Severity
5.4
First published (updated )
CVE-2022-22117
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Rangerstudio DirectusDirectus - Stored Cross-Site Scripting (XSS) via SVG File Upload

Risk 34
Severity
5.4
First published (updated )
CVE-2022-22116

Rangerstudio Directus 7interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text…

Risk 27
Severity
5.3
First published (updated )
CVE-2019-13982

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203