Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.8IP-restricted policies bypassed via GraphQL WebSocket subscriptionsOpen the advisoryOct 30, 2026
- Medium6.6File uploads can write into the extensions directory, leading to code execution in overlapping storage configurationsOpen the advisoryOct 30, 2026
- High7.1Authenticated persistent Denial of Service via prototype pollution in CSV importOpen the advisoryOct 30, 2026
- Low3.1AI Chat route exposes admin-only tools to non-admin usersOpen the advisoryOct 19, 2026
- Medium5.3Public registration sends the verification email to the submitted address instead of the matched accountOpen the advisorySep 2, 2026
- Medium6.5Share update allows reassigning user_created and roleOpen the advisorySep 2, 2026
- High7.5Unauthenticated persistent Denial of Service via prototype pollution in the query parameterOpen the advisoryAug 20, 2026
- High7.7Server-side request forgery in AI chat file downloads bypasses the outbound IP deny-listOpen the advisoryAug 20, 2026
- High7.5Denial of service via image-transform endpoint accepting unvalidated target dimensionsOpen the advisoryAug 20, 2026
- Medium6.5Sensitive fields, including plaintext AI backend authorization headers, readable by minimal usersOpen the advisoryAug 20, 2026
- Medium6.5GHSA-fq27-7m2r-q6vm is listed by Manual trigger Flows can be executed by unauthenticated users.Open the advisoryAug 20, 2026
- High7.1Improper path validation in TUS uploads allows writing to arbitrary storage pathsOpen the advisoryAug 5, 2026
- Medium5.3Unauthenticated telemetry submission and settings write via pre-authorization side effects on the project owner endpointOpen the advisoryAug 5, 2026
- High8.1Missing Origin validation on WebSocket upgrades allows Cross-Site WebSocket HijackingOpen the advisoryAug 5, 2026
- Medium6.5Directus applies side effects in service overrides before permission checks, allowing unauthorized data modificationOpen the advisoryAug 5, 2026
- Medium5.4Stored cross-site scripting via unsanitized project color in the generated faviconOpen the advisoryAug 5, 2026
- High7.2SQL injection via geometry field type in PostgreSQL/PostGIS collection creationCheck if you run itEPSS 0.42%Aug 5, 2026
- High7.5Unthrottled system GraphQL resolvers allow anonymous DoS via alias amplificationOpen the advisoryAug 5, 2026
- CriticalDirectus public WebSocket clients gain unrestricted item access after a failed auth messageOpen the advisoryAug 5, 2026
- High7.7CVE-2026-61835 is listed by SSRF Protection Bypass via 0.0.0.0 in File Import.Check if you run itEPSS 0.41%Jun 24, 2026
- Low2.1A security flaw has been discovered in pixelsock directus-mcp 1.0.0.Check if you run itEPSS 0.21%May 4, 2026
- Medium6.5Directus is a real-time API and App dashboard for managing SQL database content.Check if you run itEPSS 0.17%Apr 9, 2026
- High8.8Directus is a real-time API and App dashboard for managing SQL database content.Check if you run itEPSS 0.20%Apr 9, 2026
- High8.1Directus is a real-time API and App dashboard for managing SQL database content.Check if you run itEPSS 0.34%Apr 6, 2026
- Medium6.5Directus is a real-time API and App dashboard for managing SQL database content.Check if you run itEPSS 0.36%Apr 6, 2026
Sort