Search for packages
| purl | pkg:npm/%40directus/api@23.1.3 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8jpw-gpr4-8cmh
Aliases: CVE-2025-64748 |
Directus's conceal fields are searchable if read permissions enabled ## Summary A vulnerability allows authenticated users to search concealed/sensitive fields … |
Vulnerable |
|
GHSA-cph6-524f-3hgr
Aliases: CVE-2025-64749 |
Directus Vulnerable to Information Leakage in Existing Collections ### Summary: An observable difference in error messaging was found in the … |
Vulnerable |
|
GHSA-mv33-9f6j-pfmc
Aliases: CVE-2025-55746 |
Directus allows unauthenticated file upload and file modification due to lacking input sanitization ## Summary A vulnerability exists in the … |
Vulnerable |
|
GHSA-56p6-qw3c-fq2g
Aliases: CVE-2025-30351 |
Suspended Directus user can continue to use session token to access API ### Summary Since the user status is not … |
Vulnerable |
|
GHSA-849r-qrwj-8rv4
Aliases: CVE-2024-54151 |
Directus allows unauthenticated access to WebSocket events and operations ### Summary When setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated … |
Vulnerable |
|
GHSA-jr94-gj3h-c8rf
Aliases: CVE-2026-26185 |
Directus Vulnerable to User Enumeration via Password Reset Timing Attack ### Summary A timing-based user enumeration vulnerability exists in the … |
Not vulnerable |
|
GHSA-3573-4c68-g8cc
Aliases: CVE-2026-22032 |
Directus has open redirect in SAML ## Security Advisory: Open Redirect in Directus SAML Authentication ### Summary An open redirect … |
Vulnerable |