Directus security vulnerabilities
CMS / eCommerce / ERP. Public CVE monitoring for Directus. Vendor security advisories are linked on this page.
Built for Operators of this product.
38 public records · 0 security-fix timeline events. 3 published in the last 7 days. 35 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 4
- Medium 6
- Low 1
2026-08-0611 issues2026-11-03
Known exploited
View all known exploitedNo records match this view.
Recently published
Browse catalog- Medium6.8IP-restricted policies bypassed via GraphQL WebSocket subscriptionsOpen the advisoryOct 30, 2026
- Medium6.6File uploads can write into the extensions directory, leading to code execution in overlapping storage configurationsOpen the advisoryOct 30, 2026
- High7.1Authenticated persistent Denial of Service via prototype pollution in CSV importOpen the advisoryOct 30, 2026
- Medium5.3Public registration sends the verification email to the submitted address instead of the matched accountOpen the advisorySep 2, 2026
- Medium6.5Share update allows reassigning user_created and roleOpen the advisorySep 2, 2026
- High7.5Unauthenticated persistent Denial of Service via prototype pollution in the query parameterOpen the advisoryAug 20, 2026
- High7.7Server-side request forgery in AI chat file downloads bypasses the outbound IP deny-listOpen the advisoryAug 20, 2026
- High7.5Denial of service via image-transform endpoint accepting unvalidated target dimensionsOpen the advisoryAug 20, 2026
- Medium6.5Sensitive fields, including plaintext AI backend authorization headers, readable by minimal usersOpen the advisoryAug 20, 2026
- High7.1Improper path validation in TUS uploads allows writing to arbitrary storage pathsOpen the advisoryAug 5, 2026