Vulnerabilities in Directus

60 results
Vexday analysis

Directus apresenta um perfil de risco baixo com apenas 2 CVEs catalogadas, nenhuma em exploração ativa (KEV) e sem críticas identificadas. A vulnerabilidade dominante está associada a controle de acesso (CWE-639), indicando fraquezas em autorização, mas sem evidência de atividade recente de ataque ou novas divulgações nos últimos 90 dias.

CVE-2026-35409HIGHDirectus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File ImportEPSS 0.3%CVE-2025-64749MEDIUMDirectus Vulnerable to Information Leakage in Existing CollectionsEPSS 0.3%CVE-2024-6534MEDIUMDirectus 10.13.0 - Insecure object reference via PATH presetsEPSS 0.3%CVE-2026-35413MEDIUMDirectus GraphQL Schema SDL Disclosure SettingEPSS 0.3%CVE-2023-28443MEDIUMdirectus vulnerable to Insertion of Sensitive Information into Log FileEPSS 0.3%CVE-2024-47822MEDIUMDirectus inserts access token from query string into logsEPSS 0.3%CVE-2026-10716HIGHDirectus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creationEPSS 0.3%CVE-2026-35412HIGHDirectus has a TUS Upload Authorization Bypass Allows Arbitrary File OverwriteEPSS 0.3%CVE-2025-64748MEDIUMDirectus's conceal fields are searchable if read permissions enabledEPSS 0.3%CVE-2026-35411MEDIUMDirectus is an Open Redirect in Admin 2FA Setup PageEPSS 0.3%CVE-2026-35410MEDIUMDirectus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication FlowEPSS 0.3%CVE-2025-64747MEDIUMDirectus Vulnerable to Stored Cross-site ScriptingEPSS 0.2%CVE-2024-28238LOWSession Token in URL in directusEPSS 0.2%CVE-2025-27089MEDIUMOverlapping policies allow update to non-allowed fields in directusEPSS 0.2%CVE-2026-22032MEDIUMDirectus has open redirect in SAMLEPSS 0.2%CVE-2026-39942HIGHDirectus has a Path Traversal and Broken Access Control in File Management APIEPSS 0.2%CVE-2025-64746MEDIUMDirectus has Improper Permission Handling on Deleted FieldsEPSS 0.2%CVE-2025-53885MEDIUMDirectus doesn't redact sensitive user data when logging via event hooksEPSS 0.2%CVE-2026-39943MEDIUMDirectus exposes sensitive fields in revision historyEPSS 0.2%CVE-2026-35408HIGHDirectus is Missing Cross-Origin Opener PolicyEPSS 0.2%