directus vulnerabilities
CVEs whose affected-version data names the directus package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-61835High· 7.7Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
▾ Twilightdirectus · directusEPSS 0.41%via GHSA
CVE-2026-61836High· 8.6Directus: Authorization-dependent response served from unsegmented cache key
Directus: Authorization-dependent response served from unsegmented cache key
▾ Twilightdirectus · directusEPSS 0.47%via GHSA
CVE-2024-39896High· 7.5Directus Allows Single Sign-On User Enumeration
Directus Allows Single Sign-On User Enumeration
▾ Twilightdirectus · directusEPSS 0.51%via GHSA