Search for packages
| purl | pkg:npm/%40directus/api@19.1.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8jpw-gpr4-8cmh
Aliases: CVE-2025-64748 |
Directus's conceal fields are searchable if read permissions enabled ## Summary A vulnerability allows authenticated users to search concealed/sensitive fields … |
Vulnerable |
|
GHSA-cph6-524f-3hgr
Aliases: CVE-2025-64749 |
Directus Vulnerable to Information Leakage in Existing Collections ### Summary: An observable difference in error messaging was found in the … |
Vulnerable |
|
GHSA-vw58-ph65-6rxp
Aliases: CVE-2024-47822 |
Directus inserts access token from query string into logs ### Summary Access token from query string is not redacted and … |
Vulnerable |
|
GHSA-mv33-9f6j-pfmc
Aliases: CVE-2025-55746 |
Directus allows unauthenticated file upload and file modification due to lacking input sanitization ## Summary A vulnerability exists in the … |
Vulnerable |
|
GHSA-56p6-qw3c-fq2g
Aliases: CVE-2025-30351 |
Suspended Directus user can continue to use session token to access API ### Summary Since the user status is not … |
Vulnerable |
|
GHSA-68g8-c275-xf2m
Aliases: CVE-2024-46990 |
Directus vulnerable to SSRF Loopback IP filter bypass ### Impact If you're relying on blocking access to localhost using the … |
Vulnerable |
|
GHSA-cff8-x7jv-4fm8
Aliases: CVE-2024-45596 |
Session is cached for OpenID and OAuth2 if `redirect` is not used ### Summary Unauthenticated user can access credentials of … |
Vulnerable |
|
GHSA-jr94-gj3h-c8rf
Aliases: CVE-2026-26185 |
Directus Vulnerable to User Enumeration via Password Reset Timing Attack ### Summary A timing-based user enumeration vulnerability exists in the … |
Not vulnerable |
|
GHSA-3573-4c68-g8cc
Aliases: CVE-2026-22032 |
Directus has open redirect in SAML ## Security Advisory: Open Redirect in Directus SAML Authentication ### Summary An open redirect … |
Vulnerable |