@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=27.1.0) potentially affected by CVE-2025-53889 via directus (>=11.0.0, <=11.8.0)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =27.1.0 Source cves: CVE-2025-53889 Source advisory: OSV:GHSA-7CVF-PXGP-42FC...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=27.1.0) potentially affected by CVE-2025-53887 via directus (>=11.0.0, <=11.8.0)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =27.1.0 Source cves: CVE-2025-53887 Source advisory: OSV:GHSA-RMJH-CF9Q-PV7Q...

CVE-2025-53887

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the /server/specs/oas endpoint without...

CVE-2025-53886 Directus doesn't redact tokens in Flow logs

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are logged including security sensitive data like access and refresh tokens in...

CVE-2024-28239

Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a redirect parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth...

CVE-2020-19850

An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests...

CVE-2019-13983

Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...

@arc-directus/api (>=12.0.0, <=12.0.6), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.5) +46 more potentially affected by CVE-2025-47949 via samlify (>=2.5.1, <=2.9.1)

samlify NPM version =2.5.1, =12.0.0, =1.6.3, =1.0.0, =1.0.0, =2.0.0, =9.25.0, =9.26.0, =14.0.1, =3.1.5, =1.2.2, =1.0.0-beta.1, =1.3.0 - @meta-factory/cms 0.1.1 and more Source cves: CVE-2025-47949 Source advisory: OSV:GHSA-R683-V43C-6XQV...

CVE-2025-30353

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the A...

CVE-2025-30353

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the A...

CVE-2025-30353

Directus vulnerability (CVE-2025-30353): In Directus, flows using the Webhook trigger with the Data of Last Operation response can disclose sensitive data when a ValidationError occurs. Affected versions are 9.12.0 up to, but not including, 11.5.0. The exposure includes environment variables, API...

CVE-2025-30351 Suspended Directus user can continue to use session token to access API

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens because there is a check missing in...

CVE-2025-27089

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the update action that allow access to different fields, instead of correctly checking access permissions against the item they apply for the user is...

directus (>=11.0.0, <=11.1.1) potentially affected by CVE-2025-27089 via @directus/api (>=22.0.0, <=23.0.0)

@directus/api NPM version =22.0.0, =11.0.0, =11.1.1 Source cves: CVE-2025-27089 Source advisory: OSV:GHSA-99VM-5V2H-H6R6...

@directus/api (>=20.0.0-rc.0, <=23.2.2) potentially affected by CVE-2024-6533 via directus (>=11.0.0, <=11.3.2)

directus NPM version =11.0.0, =20.0.0-rc.0, =23.2.2 Source cves: CVE-2024-6533 Source advisory: OSV:GHSA-9QRM-48QF-R2RW...

@directus/api (>=20.0.0-rc.0, <=23.1.0), directus (>=11.0.0-rc.1, <=11.1.2) potentially affected by CVE-2025-24353 via @directus/app (>=13.0.0, <=13.3.0)

@directus/app NPM version =13.0.0, =20.0.0-rc.0, =11.0.0-rc.1, =11.1.2 Source cves: CVE-2025-24353 Source advisory: OSV:GHSA-PMF4-V838-29HG...

@directus/api (>=20.0.0-rc.0, <=23.1.0) potentially affected by CVE-2025-24353 via directus (>=11.0.0, <=11.1.2)

directus NPM version =11.0.0, =20.0.0-rc.0, =23.1.0 Source cves: CVE-2025-24353 Source advisory: OSV:GHSA-PMF4-V838-29HG...

CVE-2024-54151

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions...

directus (>=11.1.0, <=11.2.2) potentially affected by CVE-2024-54151 via @directus/api (>=22.2.0, <=23.1.3)

@directus/api NPM version =22.2.0, =11.1.0, =11.2.2 Source cves: CVE-2024-54151 Source advisory: OSV:GHSA-849R-QRWJ-8RV4...

@directus/api (>=20.0.0-rc.0, <=23.1.3) potentially affected by CVE-2024-54151 via directus (>=11.0.0, <=11.2.2)

directus NPM version =11.0.0, =20.0.0-rc.0, =23.1.3 Source cves: CVE-2024-54151 Source advisory: OSV:GHSA-849R-QRWJ-8RV4...