Vulnerabilidades em directus
59 resultadosAnálise Vexday
O Directus acumula 55 CVEs catalogadas, com 10 surgidas nos últimos 90 dias, o que indica um ritmo de descoberta de vulnerabilidades que merece acompanhamento contínuo. A taxa de exploração ativa é de 0,0% — abaixo da média geral do catálogo —, e nenhuma CVE está registrada no CISA KEV, o que sugere ausência de exploração confirmada em ambiente real no momento. A falha mais comum é CWE-200 (exposição indevida de informações), padrão que tende a ser explorado em cadeias de ataque para reconhecimento e escalada. A CVE mais perigosa ativa, CVE-2022-24814, apresenta EPSS de 0,0102, indicando baixa probabilidade de exploração iminente, embora a única vulnerabilidade crítica catalogada justifique priorização na aplicação de correções.
CVE-2023-38503MEDIUMDirectus has Incorrect Permission Checking for GraphQL SubscriptionsEPSS 0.5%CVE-2024-46990MEDIUMSSRF Loopback IP filter bypass in directusEPSS 0.5%CVE-2025-53887MEDIUMDirectus's exact version number is exposed by the OpenAPI SpecEPSS 0.5%CVE-2024-34709MEDIUMDirectus Lacks Session Tokens InvalidationEPSS 0.4%CVE-2024-39699MEDIUMDirectus has a Blind SSRF On File ImportEPSS 0.4%CVE-2024-39701MEDIUMDirectus Incorrectly handles _in` filterEPSS 0.4%CVE-2025-30350MEDIUMDirectus's S3 assets become unavailable after a burst of HEAD requestsEPSS 0.4%CVE-2025-30225MEDIUMDirectus's S3 assets become unavailable after a burst of malformed transformationsEPSS 0.4%CVE-2025-53889MEDIUMDirectus missing permission checks for manual trigger FlowsEPSS 0.4%CVE-2025-53886MEDIUMDirectus doesn't redact tokens in Flow logsEPSS 0.4%CVE-2024-6533MEDIUMDirectus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_optionsEPSS 0.4%CVE-2025-24353MEDIUMDirectus privilege escalation vulnerability using Share featureEPSS 0.4%CVE-2026-35441MEDIUMDirectus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity LimitsEPSS 0.4%CVE-2026-26185MEDIUMDirectus Affected by User Enumeration via Password Reset Timing AttackEPSS 0.3%CVE-2025-30352MEDIUMDirectus `search` query parameter allows enumeration of non permitted fieldsEPSS 0.3%CVE-2025-30351LOWSuspended Directus user can continue to use session token to access APIEPSS 0.3%CVE-2024-54128MEDIUMDirectus has an HTML Injection in CommentEPSS 0.3%CVE-2026-35442HIGHDirectus: Authenticated Users Can Extract Concealed Fields via Aggregate QueriesEPSS 0.3%CVE-2026-35409HIGHDirectus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File ImportEPSS 0.3%CVE-2025-64749MEDIUMDirectus Vulnerable to Information Leakage in Existing CollectionsEPSS 0.3%