Advisories · Technology

directus.

Every CVE that names directus among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-126539 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
- directus
- CWE-636
Not analysed yet 11 Nov 2026
CVE-2026-10716 CVE record

CVSS 7.5 High

Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation
- Directus
- SQL injection
Not analysed yet 5 Aug 2026
CVE-2022-22117 CVE record

CVSS 5.4 Medium

Directus - Stored Cross-Site Scripting (XSS) in Profile Avatar Image
- directus
- Cross-site scripting (XSS)
Not analysed yet 10 Jan 2022
CVE-2022-22116 CVE record

CVSS 5.4 Medium

Directus - Stored Cross-Site Scripting (XSS) via SVG File Upload
- directus
- Cross-site scripting (XSS)
Not analysed yet 10 Jan 2022