Search for packages
| purl | pkg:npm/%40directus/api@11.1.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8jpw-gpr4-8cmh
Aliases: CVE-2025-64748 |
Directus's conceal fields are searchable if read permissions enabled ## Summary A vulnerability allows authenticated users to search concealed/sensitive fields … |
Vulnerable |
|
GHSA-cph6-524f-3hgr
Aliases: CVE-2025-64749 |
Directus Vulnerable to Information Leakage in Existing Collections ### Summary: An observable difference in error messaging was found in the … |
Vulnerable |
|
GHSA-vw58-ph65-6rxp
Aliases: CVE-2024-47822 |
Directus inserts access token from query string into logs ### Summary Access token from query string is not redacted and … |
Vulnerable |
|
GHSA-8p72-rcq4-h6pw
Aliases: CVE-2024-39699 |
Directus Blind SSRF On File Import ### Summary There was already a reported SSRF vulnerability via file import. [https://github.com/directus/directus/security/advisories/GHSA-j3rg-3rgm-537h](https://github.com/directus/directus/security/advisories/GHSA-j3rg-3rgm-537h) It … |
Vulnerable |
|
GHSA-68g8-c275-xf2m
Aliases: CVE-2024-46990 |
Directus vulnerable to SSRF Loopback IP filter bypass ### Impact If you're relying on blocking access to localhost using the … |
Vulnerable |
|
GHSA-cff8-x7jv-4fm8
Aliases: CVE-2024-45596 |
Session is cached for OpenID and OAuth2 if `redirect` is not used ### Summary Unauthenticated user can access credentials of … |
Vulnerable |
|
GHSA-jr94-gj3h-c8rf
Aliases: CVE-2026-26185 |
Directus Vulnerable to User Enumeration via Password Reset Timing Attack ### Summary A timing-based user enumeration vulnerability exists in the … |
Not vulnerable |
|
GHSA-3573-4c68-g8cc
Aliases: CVE-2026-22032 |
Directus has open redirect in SAML ## Security Advisory: Open Redirect in Directus SAML Authentication ### Summary An open redirect … |
Vulnerable |