@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=27.1.0) potentially affected by CVE-2025-53887 via directus (>=11.0.0-rc.1, <=11.8.0)

directus NPM version =11.0.0-rc.1, =1.6.3, =20.0.0-rc.0, =27.1.0 Source cves: CVE-2025-53887 Source advisory: OSV:GHSA-RMJH-CF9Q-PV7Q...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=27.1.0) potentially affected by CVE-2025-53886 via directus (>=11.0.0-rc.1, <=11.8.0)

directus NPM version =11.0.0-rc.1, =1.6.3, =20.0.0-rc.0, =27.1.0 Source cves: CVE-2025-53886 Source advisory: OSV:GHSA-F24X-RM6G-3W5V...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=27.1.0) potentially affected by CVE-2025-53886 via directus (>=11.0.0-rc.1, <=11.8.0)

directus NPM version =11.0.0-rc.1, =1.6.3, =20.0.0-rc.0, =27.1.0 Source cves: CVE-2025-53886 Source advisory: GHSA-F24X-RM6G-3W5V...

CVE-2025-53887

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the /server/specs/oas endpoint without...

CVE-2025-53886 Directus doesn't redact tokens in Flow logs

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are logged including security sensitive data like access and refresh tokens in...

CVE-2024-28239

Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a redirect parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth...

CVE-2020-19850

An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests...

CVE-2019-13983

Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...

@arc-directus/api (>=12.0.0, <=12.0.6), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.5) +46 more potentially affected by CVE-2025-47949 via samlify (>=2.5.1, <=2.9.1)

samlify NPM version =2.5.1, =12.0.0, =1.6.3, =1.0.0, =1.0.0, =2.0.0, =9.25.0, =9.26.0, =14.0.1, =3.1.5, =1.2.2, =1.0.0-beta.1, =1.3.0 - @meta-factory/cms 0.1.1 and more Source cves: CVE-2025-47949 Source advisory: OSV:GHSA-R683-V43C-6XQV...

directus (11.0.0-rc.3) potentially affected by CVE-2024-47822 via @directus/api (21.0.0-rc.0)

@directus/api NPM version 21.0.0-rc.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/api and may be impacted: - directus 11.0.0-rc.3 Source cves: CVE-2024-47822 Source advisory: OSV:GHSA-VW58-PH65-6RXP...

directus (11.0.0-rc.3) potentially affected by CVE-2024-47822 via @directus/api (21.0.0-rc.0)

@directus/api NPM version 21.0.0-rc.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/api and may be impacted: - directus 11.0.0-rc.3 Source cves: CVE-2024-47822 Source advisory: GHSA-VW58-PH65-6RXP...

CVE-2025-30353

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the A...

@directus/api (21.0.1), @linotype/directus-extension-linotype (>=1.2.2, <=1.3.5) +3 more potentially affected by CVE-2025-30351 via @directus/api (>=18.0.0, <=24.0.0)

@directus/api NPM version =18.0.0, =1.2.2, =10.10.0, =1.0.0, =2.0.0 - directus-extension-blog-year-filter 1.0.0 Source cves: CVE-2025-30351 Source advisory: GHSA-56P6-QW3C-FQ2G...

CVE-2025-30353

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the A...

CVE-2025-30353

Directus vulnerability (CVE-2025-30353): In Directus, flows using the Webhook trigger with the Data of Last Operation response can disclose sensitive data when a ValidationError occurs. Affected versions are 9.12.0 up to, but not including, 11.5.0. The exposure includes environment variables, API...

@deconz-community/directus-extension-ddf-store (0.1.0), @directus/api (21.0.1) +11 more potentially affected by CVE-2025-30353 via @directus/api (>=9.25.0, <=24.0.1)

@directus/api NPM version =9.25.0, =1.2.2, =0.1.0, =9.25.0, =1.0.0, =1.0.1, =1.0.0, =1.0.75 - nuxtus-server 1.0.0 Source cves: CVE-2025-30353 Source advisory: MEND:CVE-2025-30353...

@deconz-community/directus-extension-ddf-store (0.1.0), @directus/api (21.0.1) +11 more potentially affected by CVE-2025-30352 via @directus/api (>=9.25.0, <=24.0.1)

@directus/api NPM version =9.25.0, =1.2.2, =0.1.0, =9.25.0, =1.0.0, =1.0.1, =1.0.0, =1.0.75 - nuxtus-server 1.0.0 Source cves: CVE-2025-30352 Source advisory: MEND:CVE-2025-30352...

CVE-2025-30351 Suspended Directus user can continue to use session token to access API

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens because there is a check missing in...

@directus/api (21.0.1), @linotype/directus-extension-linotype (>=1.2.2, <=1.3.5) +3 more potentially affected by CVE-2025-30351 via @directus/api (>=18.0.0, <=24.0.1)

@directus/api NPM version =18.0.0, =1.2.2, =10.10.0, =1.0.0, =2.0.0 - directus-extension-blog-year-filter 1.0.0 Source cves: CVE-2025-30351 Source advisory: MEND:CVE-2025-30351...

CVE-2025-27089

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the update action that allow access to different fields, instead of correctly checking access permissions against the item they apply for the user is...