53 matches found
EUVD-2026-20950
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/id endpoint accepts a user-controlled filenamedisk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content...
Information Exposure
Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Information Exposure via the password reset functionality. An attacker can determine the existence of user accounts by measuring response time...
CVE-2023-45820
Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has...
CVE-2024-39895
Directus is a real-time API and App dashboard for managing SQL database content. A denial of service DoS attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single...
GHSA-CPH6-524F-3HGR Directus Vulnerable to Information Leakage in Existing Collections
Summary: An observable difference in error messaging was found in the Directus REST API. The /items/collection API returns different error messages for these two cases: 1. A user tries to access an existing collection which they are not authorized to access. 2. A user tries to access a non-existi...
Insertion of Sensitive Information Into Sent Data
Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data due to concealed fields being searchable if read permissions enabled. An attacker can infer the...
CVE-2025-64749
Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The /items/collection API returns different error messages for two cases: when a user...
Access Control Bypass
Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Access Control Bypass due to improper cleanup of field-level permissions when a field is deleted. An attacker can gain unauthorized access to data by...
EUVD-2019-5241
Malware in sbrugna...
EUVD-2019-5242
Malware in sbrugna...
EUVD-2022-1872
Malicious code in bioql PyPI...
EUVD-2023-1043
Malicious code in bioql PyPI...
EUVD-2024-1709
Malicious code in bioql PyPI...
EUVD-2024-2730
Malicious code in bioql PyPI...
EUVD-2023-2063
Malicious code in bioql PyPI...
EUVD-2024-2769
Malicious code in bioql PyPI...
EUVD-2025-4664
Malicious code in bioql PyPI...
EUVD-2024-0833
Malicious code in bioql PyPI...