78 matches found
EUVD-2026-20950
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/id endpoint accepts a user-controlled filenamedisk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content...
directus (>=11.13.0, <=11.13.4) potentially affected by CVE-2026-26185 via @directus/api (>=32.0.0, <=32.1.1)
@directus/api NPM version =32.0.0, =11.13.0, =11.13.4 Source cves: CVE-2026-26185 Source advisory: OSV:GHSA-JR94-GJ3H-C8RF...
Information Exposure
Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Information Exposure via the password reset functionality. An attacker can determine the existence of user accounts by measuring response time...
CVE-2023-45820
Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has...
CVE-2024-39895
Directus is a real-time API and App dashboard for managing SQL database content. A denial of service DoS attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single...
directus (>=11.13.0, <=11.13.3) potentially affected by CVE-2026-22032 via @directus/api (>=32.0.0, <=32.1.0)
@directus/api NPM version =32.0.0, =11.13.0, =11.13.3 Source cves: CVE-2026-22032 Source advisory: OSV:GHSA-3573-4C68-G8CC...
directus (>=11.13.0, <=11.13.4) potentially affected by CVE-2026-22032 via @directus/api (>=32.0.0, <=32.1.1)
@directus/api NPM version =32.0.0, =11.13.0, =11.13.4 Source cves: CVE-2026-22032 Source advisory: SNYK:JS-DIRECTUSAPI-14892568...
@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=31.0.0) +1 more potentially affected by CVE-2025-64746 via directus (>=11.0.0, <=11.12.0)
directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =31.0.0 - @fahami/directus-pkce 1.0.0 Source cves: CVE-2025-64746 Source advisory: OSV:GHSA-9X5G-62GJ-WQF2...
GHSA-CPH6-524F-3HGR Directus Vulnerable to Information Leakage in Existing Collections
Summary: An observable difference in error messaging was found in the Directus REST API. The /items/collection API returns different error messages for these two cases: 1. A user tries to access an existing collection which they are not authorized to access. 2. A user tries to access a non-existi...
Insertion of Sensitive Information Into Sent Data
Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data due to concealed fields being searchable if read permissions enabled. An attacker can infer the...
CVE-2025-64749
Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The /items/collection API returns different error messages for two cases: when a user...
@directus/api (31.0.0), directus (11.12.0) potentially affected by CVE-2025-64747 via @directus/app (14.0.0)
@directus/app NPM version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/app and may be impacted: - @directus/api 31.0.0 - directus 11.12.0 Source cves: CVE-2025-64747 Source advisory: SNYK:JS-DIRECTUSAPP-13985180...
directus (>=11.13.0, <=11.13.1) potentially affected by CVE-2025-64746 via @directus/api (>=32.0.0, <=32.0.1)
@directus/api NPM version =32.0.0, =11.13.0, =11.13.1 Source cves: CVE-2025-64746 Source advisory: SNYK:JS-DIRECTUSAPI-13985179...
Access Control Bypass
Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Access Control Bypass due to improper cleanup of field-level permissions when a field is deleted. An attacker can gain unauthorized access to data by...
EUVD-2019-5242
Malware in sbrugna...
EUVD-2019-5241
Malware in sbrugna...
EUVD-2023-1043
Malicious code in bioql PyPI...
EUVD-2024-1709
Malicious code in bioql PyPI...