903 matches found
CVE-2026-22032
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the RelayState parameter is intended to preserve the user's original...
EUVD-2026-0980
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the RelayState parameter is intended to preserve the user's original...
CVE-2026-22032 Directus has open redirect in SAML
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the RelayState parameter is intended to preserve the user's original...
CVE-2026-22032 Directus has open redirect in SAML
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the RelayState parameter is intended to preserve the user's original...
CVE-2026-22032
Directus before v11.14.0 has an open redirect in the SAML authentication callback endpoint. The RelayState used to preserve the original destination is not validated for the callback, enabling an attacker to redirect users to an arbitrary external URL after login completion. The issue affects bot...
CVE-2026-22032 Directus has open redirect in SAML
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the RelayState parameter is intended to preserve the user's original...
Directus 输入验证错误漏洞
Directus is Directus open source a real-time Api and application dashboard . It is used to manage Sql database content. An input validation error vulnerability exists in Directus versions prior to 11.14.0, which stems from an open redirection in the SAML authentication callback endpoint, which...
PT-2026-2139
Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.14.0 Description Directus is a real-time API and App dashboard for managing SQL database content. An open redirect exists in the Directus SAML authentication callback endpoint. The RelayState parameter, intended t...
directus (>=11.13.0, <=11.13.3) potentially affected by CVE-2026-22032 via @directus/api (>=32.0.0, <=32.1.0)
@directus/api NPM version =32.0.0, =11.13.0, =11.13.3 Source cves: CVE-2026-22032 Source advisory: OSV:GHSA-3573-4C68-G8CC...
@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=32.1.1) +1 more potentially affected by CVE-2026-22032 via directus (>=11.0.0, <=11.13.4)
directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =32.1.1 - @fahami/directus-pkce 1.0.0 Source cves: CVE-2026-22032 Source advisory: OSV:GHSA-3573-4C68-G8CC...
GHSA-3573-4C68-G8CC Directus has open redirect in SAML
Security Advisory: Open Redirect in Directus SAML Authentication Summary An open redirect vulnerability exists in the Directus SAML authentication callback endpoint. The RelayState parameter is used in redirects without proper validation against an allowlist of permitted domains. Vulnerability...
directus (>=11.13.0, <=11.13.4) potentially affected by CVE-2026-22032 via @directus/api (>=32.0.0, <=32.1.1)
@directus/api NPM version =32.0.0, =11.13.0, =11.13.4 Source cves: CVE-2026-22032 Source advisory: SNYK:JS-DIRECTUSAPI-14892568...
Open Redirect
Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Open Redirect via the RelayState parameter, which is used in redirects without proper validation against an allowlist of permitted domains. An attacker...
Directus has open redirect in SAML
Security Advisory: Open Redirect in Directus SAML Authentication Summary An open redirect vulnerability exists in the Directus SAML authentication callback endpoint. The RelayState parameter is used in redirects without proper validation against an allowlist of permitted domains. Vulnerability...
@adamstankiewicz/openedx-frontend-platform (>=8.2.0, <=8.3.6), @altipla/directus-sdk-utils (0.7.2) +38 more potentially affected by CVE-2025-69202 via axios-cache-interceptor (>=1.0.0, <=1.8.3)
axios-cache-interceptor NPM version =1.0.0, =8.2.0, =1.6.3, =1.1.0, =15.0.0, =11.0.4, =1.0.2-test-cache.1, =8.1.2-alpha.1, =8.1.0, =8.5.2 - @fahami/directus-pkce 1.0.0 and more Source cves: CVE-2025-69202 Source advisory: OSV:GHSA-X4M5-4CW8-VC44...
@adamstankiewicz/openedx-frontend-platform (>=8.2.0, <=8.3.6), @altipla/directus-sdk-utils (0.7.2) +38 more potentially affected by CVE-2025-69202 via axios-cache-interceptor (>=1.0.0, <=1.8.3)
axios-cache-interceptor NPM version =1.0.0, =8.2.0, =1.6.3, =1.1.0, =15.0.0, =11.0.4, =1.0.2-test-cache.1, =8.1.2-alpha.1, =8.1.0, =8.5.2 - @fahami/directus-pkce 1.0.0 and more Source cves: CVE-2025-69202 Source advisory: SNYK:JS-AXIOSCACHEINTERCEPTOR-14724265...
CVE-2025-64748
Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked , successful matches can be detected...
CVE-2025-64747
Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS vulnerability exists in versions prior to 11.13.0 that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface...
CVE-2025-64749
Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The /items/collection API returns different error messages for two cases: when a user...