Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,898All CVEsplus 19,117 rejected
- 446Last 24 hours2,915 in the last 7 days
- 16,799Last 30 days1,554 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 8 | 7 | 0 | 0 | 15 | 60 |
| 2025 | 1 | 1 | 13 | 1 | 0 | 16 | 45 |
| 2024 | 0 | 5 | 12 | 1 | 0 | 18 | 29 |
| 2023 | 0 | 1 | 5 | 0 | 0 | 6 | 11 |
| 2022 | 0 | 1 | 4 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-10716 | Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creationDirectus · Directus | High7.5 |
| CVE-2026-61836 | Directus: Authorization-dependent response served from unsegmented cache keydirectus · directus | High8.6 |
| CVE-2026-61835 | Directus: SSRF Protection Bypass via 0.0.0.0 in File Importdirectus · directus | High7.7 |
| CVE-2026-39943 | Directus exposes sensitive fields in revision historydirectus · directus | Medium6.5 |
| CVE-2026-39942 | Directus has a Path Traversal and Broken Access Control in File Management APIdirectus · directus | High8.5 |
| CVE-2026-35442 | Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queriesdirectus · directus | High8.1 |
| CVE-2026-35441 | Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limitsdirectus · directus | Medium6.5 |
| CVE-2026-35413 | Directus GraphQL Schema SDL Disclosure Settingdirectus · directus | Medium5.3 |
| CVE-2026-35412 | Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwritedirectus · directus | High7.1 |
| CVE-2026-35411 | Directus is an Open Redirect in Admin 2FA Setup Pagedirectus · directus | Medium4.3 |
| CVE-2026-35410 | Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flowdirectus · directus | Medium6.1 |
| CVE-2026-35409 | Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Importdirectus · directus | High7.7 |
| CVE-2026-35408 | Directus is Missing Cross-Origin Opener Policydirectus · directus | High8.7 |
| CVE-2026-26185 | Directus Affected by User Enumeration via Password Reset Timing Attackdirectus · directus | Medium5.3 |
| CVE-2026-22032 | Directus has open redirect in SAMLdirectus · directus | Medium4.3 |
| CVE-2025-64749 | Directus Vulnerable to Information Leakage in Existing Collectionsdirectus · directus | Medium4.3 |
| CVE-2025-64748 | Directus's conceal fields are searchable if read permissions enableddirectus · directus | Medium6.5 |
| CVE-2025-64747 | Directus Vulnerable to Stored Cross-site Scriptingdirectus · directus | Medium5.5 |
| CVE-2025-64746 | Directus has Improper Permission Handling on Deleted Fieldsdirectus · directus | Medium4.6 |
| CVE-2025-55746 | Directus allows unauthenticated file upload and file modification due to lacking input sanitizationdirectus · directus | Critical9.3 |
| CVE-2025-53889 | Directus missing permission checks for manual trigger Flowsdirectus · directus | Medium6.5 |
| CVE-2025-53887 | Directus's exact version number is exposed by the OpenAPI Specdirectus · directus | Medium5.3 |
| CVE-2025-53886 | Directus doesn't redact tokens in Flow logsdirectus · directus | Medium4.5 |
| CVE-2025-53885 | Directus doesn't redact sensitive user data when logging via event hooksdirectus · directus | Medium4.2 |
| CVE-2025-30353 | Directus's webhook trigger flows can leak sensitive datadirectus · directus | High8.6 |
| CVE-2025-30352 | Directus `search` query parameter allows enumeration of non permitted fieldsdirectus · directus | Medium5.3 |
| CVE-2025-30351 | Suspended Directus user can continue to use session token to access APIdirectus · directus | Low3.5 |
| CVE-2025-30350 | Directus's S3 assets become unavailable after a burst of HEAD requestsdirectus · directus | Medium5.3 |
| CVE-2025-30225 | Directus's S3 assets become unavailable after a burst of malformed transformationsdirectus · directus | Medium5.3 |
| CVE-2025-27089 | Overlapping policies allow update to non-allowed fields in directusdirectus · directus | Medium5.4 |
| CVE-2025-24353 | Directus privilege escalation vulnerability using Share featuredirectus · directus | Medium5.0 |
| CVE-2024-54151 | Directus allows unauthenticated access to WebSocket events and operationsdirectus · directus | High7.5 |
| CVE-2024-54128 | Directus has an HTML Injection in Commentdirectus · directus | Medium5.7 |
| CVE-2024-47822 | Directus inserts access token from query string into logsdirectus · directus | Medium4.2 |
| CVE-2024-46990 | SSRF Loopback IP filter bypass in directusdirectus · directus | Medium5.0 |
| CVE-2024-45596 | Directus's session is cached for OpenID and OAuth2 if `redirect` is not useddirectus · directus | High7.4 |
| CVE-2024-6534 | Directus 10.13.0 - Insecure object reference via PATH presetsDirectus · Directus | Medium4.3 |
| CVE-2024-6533 | Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_optionsDirectus · Directus | Medium5.4 |
| CVE-2024-39896 | Directus allows SSO User Enumerationdirectus · directus | High7.5 |
| CVE-2024-39895 | Directus GraphQL Field Duplication Denial of Service (DoS)directus · directus | Medium6.5 |
| CVE-2024-39701 | Directus Incorrectly handles _in` filterdirectus · directus | Medium6.3 |
| CVE-2024-39699 | Directus has a Blind SSRF On File Importdirectus · directus | Medium5.0 |
| CVE-2024-36128 | Directus is soft-locked by providing a string value to random string utildirectus · directus | High7.5 |
| CVE-2024-34709 | Directus Lacks Session Tokens Invalidationdirectus · directus | Medium5.4 |
| CVE-2024-34708 | Directus allows redacted data extraction on the API through "alias"directus · directus | Medium4.9 |
| CVE-2024-28238 | Session Token in URL in directusdirectus · directus | Low2.3 |
| CVE-2024-28239 | URL Redirection to Untrusted Site in OAuth2/OpenID in directusdirectus · directus | Medium5.4 |
| CVE-2024-27296 | Directus version number disclosuredirectus · directus | Medium5.3 |
| CVE-2024-27295 | Directus MySQL accent insensitive email matchingdirectus · directus | High8.2 |
| CVE-2023-45820 | Directus crashes on invalid WebSocket messagedirectus · directus | Medium5.9 |