Search for packages
| purl | pkg:npm/%40directus/api@21.0.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8jpw-gpr4-8cmh
Aliases: CVE-2025-64748 |
Directus's conceal fields are searchable if read permissions enabled ## Summary A vulnerability allows authenticated users to search concealed/sensitive fields … |
Vulnerable |
|
GHSA-cph6-524f-3hgr
Aliases: CVE-2025-64749 |
Directus Vulnerable to Information Leakage in Existing Collections ### Summary: An observable difference in error messaging was found in the … |
Vulnerable |
|
GHSA-mv33-9f6j-pfmc
Aliases: CVE-2025-55746 |
Directus allows unauthenticated file upload and file modification due to lacking input sanitization ## Summary A vulnerability exists in the … |
Vulnerable |
|
GHSA-56p6-qw3c-fq2g
Aliases: CVE-2025-30351 |
Suspended Directus user can continue to use session token to access API ### Summary Since the user status is not … |
Vulnerable |
|
GHSA-jr94-gj3h-c8rf
Aliases: CVE-2026-26185 |
Directus Vulnerable to User Enumeration via Password Reset Timing Attack ### Summary A timing-based user enumeration vulnerability exists in the … |
Not vulnerable |
|
GHSA-3573-4c68-g8cc
Aliases: CVE-2026-22032 |
Directus has open redirect in SAML ## Security Advisory: Open Redirect in Directus SAML Authentication ### Summary An open redirect … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-cff8-x7jv-4fm8
|
Session is cached for OpenID and OAuth2 if `redirect` is not used ### Summary Unauthenticated user can access credentials of … |
CVE-2024-45596
|