Vulnerabilidades em directus
60 resultadosAnálise Vexday
O Directus acumula 55 CVEs catalogadas, com 10 surgidas nos últimos 90 dias, o que indica um ritmo de descoberta de vulnerabilidades que merece acompanhamento contínuo. A taxa de exploração ativa é de 0,0% — abaixo da média geral do catálogo —, e nenhuma CVE está registrada no CISA KEV, o que sugere ausência de exploração confirmada em ambiente real no momento. A falha mais comum é CWE-200 (exposição indevida de informações), padrão que tende a ser explorado em cadeias de ataque para reconhecimento e escalada. A CVE mais perigosa ativa, CVE-2022-24814, apresenta EPSS de 0,0102, indicando baixa probabilidade de exploração iminente, embora a única vulnerabilidade crítica catalogada justifique priorização na aplicação de correções.
CVE-2026-35409HIGHDirectus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File ImportEPSS 0.3%CVE-2025-64749MEDIUMDirectus Vulnerable to Information Leakage in Existing CollectionsEPSS 0.3%CVE-2024-6534MEDIUMDirectus 10.13.0 - Insecure object reference via PATH presetsEPSS 0.3%CVE-2026-35413MEDIUMDirectus GraphQL Schema SDL Disclosure SettingEPSS 0.3%CVE-2023-28443MEDIUMdirectus vulnerable to Insertion of Sensitive Information into Log FileEPSS 0.3%CVE-2024-47822MEDIUMDirectus inserts access token from query string into logsEPSS 0.3%CVE-2026-10716HIGHDirectus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creationEPSS 0.3%CVE-2026-35412HIGHDirectus has a TUS Upload Authorization Bypass Allows Arbitrary File OverwriteEPSS 0.3%CVE-2025-64748MEDIUMDirectus's conceal fields are searchable if read permissions enabledEPSS 0.3%CVE-2026-35411MEDIUMDirectus is an Open Redirect in Admin 2FA Setup PageEPSS 0.3%CVE-2026-35410MEDIUMDirectus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication FlowEPSS 0.3%CVE-2025-64747MEDIUMDirectus Vulnerable to Stored Cross-site ScriptingEPSS 0.2%CVE-2024-28238LOWSession Token in URL in directusEPSS 0.2%CVE-2025-27089MEDIUMOverlapping policies allow update to non-allowed fields in directusEPSS 0.2%CVE-2026-22032MEDIUMDirectus has open redirect in SAMLEPSS 0.2%CVE-2026-39942HIGHDirectus has a Path Traversal and Broken Access Control in File Management APIEPSS 0.2%CVE-2025-64746MEDIUMDirectus has Improper Permission Handling on Deleted FieldsEPSS 0.2%CVE-2025-53885MEDIUMDirectus doesn't redact sensitive user data when logging via event hooksEPSS 0.2%CVE-2026-39943MEDIUMDirectus exposes sensitive fields in revision historyEPSS 0.2%CVE-2026-35408HIGHDirectus is Missing Cross-Origin Opener PolicyEPSS 0.2%