@depup/directus (12.3.0-depup.0), directus (12.3.0) potentially affected by unknown CVE via @directus/api (39.0.0)

@directus/api NPM version 39.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/api and may be impacted: - @depup/directus 12.3.0-depup.0 - directus 12.3.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0110...

@depup/directus (12.3.0-depup.0), directus (12.3.0) potentially affected by unknown CVE via @directus/api (39.0.0)

@directus/api NPM version 39.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/api and may be impacted: - @depup/directus 12.3.0-depup.0 - directus 12.3.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0109...

@directus/api (>=36.0.0-rc.0, <=36.0.0-rc.1) potentially affected by CVE-2026-61836 via directus (>=12.0.0-rc.1, <=12.0.0-rc.2)

directus NPM version =12.0.0-rc.1, =36.0.0-rc.0, =36.0.0-rc.1 Source cves: CVE-2026-61836 Source advisory: OSV:GHSA-C6W9-5G5J-JH2P...

@directus/api (>=36.0.0-rc.0, <=36.0.0-rc.1) potentially affected by CVE-2026-61836 via directus (>=12.0.0-rc.1, <=12.0.0-rc.2)

directus NPM version =12.0.0-rc.1, =36.0.0-rc.0, =36.0.0-rc.1 Source cves: CVE-2026-61836 Source advisory: GHSA-C6W9-5G5J-JH2P...

@directus/api (>=36.0.0-rc.0, <=36.0.0-rc.1) potentially affected by CVE-2026-61835 via directus (>=12.0.0-rc.1, <=12.0.0-rc.2)

directus NPM version =12.0.0-rc.1, =36.0.0-rc.0, =36.0.0-rc.1 Source cves: CVE-2026-61835 Source advisory: OSV:GHSA-J5H6-VQC3-PHQH...

@directus/api (>=36.0.0-rc.0, <=36.0.0-rc.1) potentially affected by CVE-2026-61835 via directus (>=12.0.0-rc.1, <=12.0.0-rc.2)

directus NPM version =12.0.0-rc.1, =36.0.0-rc.0, =36.0.0-rc.1 Source cves: CVE-2026-61835 Source advisory: GHSA-J5H6-VQC3-PHQH...

Server-side Request Forgery (SSRF)

Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the file-import-from-URL. An attacker can access internal network resources by supplying the address 0.0.0.0 to th...

directus (12.0.0-rc.1) potentially affected by CVE-2026-61835 via @directus/api (36.0.0-rc.0)

@directus/api NPM version 36.0.0-rc.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/api and may be impacted: - directus 12.0.0-rc.1 Source cves: CVE-2026-61835 Source advisory: SNYK:JS-DIRECTUSAPI-18017744...

directus (>=12.0.0-rc.1, <=12.0.0-rc.2) potentially affected by CVE-2026-61836 via @directus/api (>=36.0.0-rc.0, <=36.0.0-rc.1)

@directus/api NPM version =36.0.0-rc.0, =12.0.0-rc.1, =12.0.0-rc.2 Source cves: CVE-2026-61836 Source advisory: SNYK:JS-DIRECTUSAPI-18017743...

Use of Cache Containing Sensitive Information

Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information through the get-cache-key. An attacker can access unauthorized cached responses by making requests with...

EUVD-2026-20950

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/id endpoint accepts a user-controlled filenamedisk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content...

directus (>=11.13.0, <=11.13.4) potentially affected by CVE-2026-26185 via @directus/api (>=32.0.0, <=32.1.1)

@directus/api NPM version =32.0.0, =11.13.0, =11.13.4 Source cves: CVE-2026-26185 Source advisory: OSV:GHSA-JR94-GJ3H-C8RF...

Information Exposure

Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Information Exposure via the password reset functionality. An attacker can determine the existence of user accounts by measuring response time...

directus (>=11.13.0, <=11.13.4) potentially affected by CVE-2026-26185 via @directus/api (>=32.0.0, <=32.1.1)

@directus/api NPM version =32.0.0, =11.13.0, =11.13.4 Source cves: CVE-2026-26185 Source advisory: GHSA-JR94-GJ3H-C8RF...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @deconz-community/directus-extension-ddf-store (0.1.0) +13 more potentially affected by CVE-2026-26185 via @directus/api (>=9.25.0, <=32.1.1)

@directus/api NPM version =9.25.0, =1.6.3, =1.2.2, =0.1.0, =9.25.0, =1.0.0, =1.0.1, =1.0.0, =1.0.75 - nuxtus-server 1.0.0 Source cves: CVE-2026-26185 Source advisory: MEND:CVE-2026-26185...

CVE-2023-45820

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has...

CVE-2024-39895

Directus is a real-time API and App dashboard for managing SQL database content. A denial of service DoS attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @deconz-community/directus-extension-ddf-store (0.1.0) +13 more potentially affected by CVE-2026-22032 via @directus/api (>=9.25.0, <=32.1.0)

@directus/api NPM version =9.25.0, =1.6.3, =1.2.2, =0.1.0, =9.25.0, =1.0.0, =1.0.1, =1.0.0, =1.0.75 - nuxtus-server 1.0.0 Source cves: CVE-2026-22032 Source advisory: MEND:CVE-2026-22032...

directus (>=11.13.0, <=11.13.3) potentially affected by CVE-2026-22032 via @directus/api (>=32.0.0, <=32.1.0)

@directus/api NPM version =32.0.0, =11.13.0, =11.13.3 Source cves: CVE-2026-22032 Source advisory: OSV:GHSA-3573-4C68-G8CC...

directus (>=11.13.0, <=11.13.4) potentially affected by CVE-2026-22032 via @directus/api (>=32.0.0, <=32.1.1)

@directus/api NPM version =32.0.0, =11.13.0, =11.13.4 Source cves: CVE-2026-22032 Source advisory: SNYK:JS-DIRECTUSAPI-14892568...