directus vulnerabilities

CVEs per yearBy the year they were published

1. 20225
2. 20236
3. 202418
4. 202516
5. 202615

Newest CVEs

• CVE-2026-10716

  Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation

  Directus · Directus

  High7.5
• CVE-2026-61836

  Directus: Authorization-dependent response served from unsegmented cache key

  directus · directus

  High8.6
• CVE-2026-61835

  Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

  directus · directus

  High7.7
• CVE-2026-39943

  Directus exposes sensitive fields in revision history

  directus · directus

  Medium6.5
• CVE-2026-39942

  Directus has a Path Traversal and Broken Access Control in File Management API

  directus · directus

  High8.5
• CVE-2026-35442

  Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries

  directus · directus

  High8.1
• CVE-2026-35441

  Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits

  directus · directus

  Medium6.5
• CVE-2026-35413

  Directus GraphQL Schema SDL Disclosure Setting

  directus · directus

  Medium5.3
• CVE-2026-35412

  Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite

  directus · directus

  High7.1
• CVE-2026-35411

  Directus is an Open Redirect in Admin 2FA Setup Page

  directus · directus

  Medium4.3