High
CVE-2026-61836
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 61
Reset filters
High
CVE-2026-61835
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
High
CVE-2026-35442
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
High
ghsa-6q22-g298-grjh
Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver
Medium
CVE-2026-35441
Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits
Medium
CVE-2026-39943
Directus: Sensitive fields exposed in revision history
High
CVE-2026-35412
Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
High
CVE-2026-35409
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
Medium
CVE-2026-35413
Directus: GraphQL Schema SDL Disclosure Setting
Medium
CVE-2026-35410
Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
Medium
CVE-2026-35411
Directus: Open Redirect in Admin 2FA Setup Page
High
CVE-2026-39942
Directus: Path Traversal and Broken Access Control in File Management API
High
CVE-2026-35408
Directus: Missing Cross-Origin Opener Policy
Medium
CVE-2026-26185
Directus Vulnerable to User Enumeration via Password Reset Timing Attack
Medium
CVE-2026-22032
Directus has open redirect in SAML
Medium
CVE-2025-64747
Directus is Vulnerable to Stored Cross-site Scripting
Medium
CVE-2025-64746
Directus has Improper Permission Handling on Deleted Fields
Medium
CVE-2025-64749
Directus Vulnerable to Information Leakage in Existing Collections
Medium
CVE-2025-64748
Directus's conceal fields are searchable if read permissions enabled
Critical
CVE-2025-55746
Directus allows unauthenticated file upload and file modification due to lacking input sanitization
Medium
CVE-2025-53889
Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows
Medium
CVE-2025-53887
Directus' exact version number is exposed by the OpenAPI Spec
Medium
CVE-2025-53886
Directus tokens are not redacted in flow logs, exposing session credentials to all admin
Medium
CVE-2025-53885
Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.