directus directus

Name: directus directus
Brand: directus

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical8high24medium3low

updated 2026-10-28

vulnerabilities (58)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-55746US	high7.5	1.40% (72nd)	Exploit	11.9.3	2025-08-20	10.8.0, → 11.9.3
CVE-2025-53887US	—	1.02% (63rd)	Exploit	11.9.0	2025-07-15	9.0.0, → 11.9.0
CVE-2022-24814US	medium6.1	1.03% (64th)	—	no fix	2022-04-04	≤ < 9.7.0
CVE-2022-36031US	medium6.5	0.97% (62nd)	—	no fix	2022-08-19	≤ < 9.15.0
CVE-2023-26492US	high7.5	0.96% (61st)	—	no fix	2023-03-03	≤ < 9.23.0
CVE-2023-45820US	medium6.5	0.83% (57th)	—	10.6.2	2023-10-19	10.4, → 10.6.2
CVE-2022-23080US	medium5.0	0.83% (57th)	—	unspecified	2022-06-22	2 versions
CVE-2024-39895US	medium6.5	0.80% (56th)	—	no fix	2024-07-08	≤ < 10.12.0
CVE-2024-34708US	medium4.9	0.76% (55th)	—	no fix	2024-05-14	≤ < 10.11.0
CVE-2024-27295US	high8.2	0.70% (53rd)	—	no fix	2024-03-01	2 versions
CVE-2024-54151US	—	0.69% (53rd)	—	11.3.0	2024-12-09	11.0.0, → 11.3.0
CVE-2024-45596US	medium6.5	0.66% (51st)	—	11.1.0	2024-09-10	2 versions
CVE-2022-22117US	low3.5	0.63% (50th)	—	unspecified	2022-01-10	2 versions
CVE-2022-22116US	low3.5	0.63% (50th)	—	unspecified	2022-01-10	2 versions
CVE-2024-36128US	high7.5	0.62% (49th)	—	no fix	2024-06-03	≤ < 10.11.2
CVE-2023-27481US	medium4.3	0.60% (49th)	—	no fix	2023-03-07	≤ < 9.16.0
CVE-2024-28239US	medium4.3	0.58% (48th)	—	no fix	2024-03-12	2 versions
CVE-2024-27296US	medium5.3	0.57% (47th)	—	no fix	2024-03-01	2 versions
CVE-2023-27474US	medium5.4	0.53% (45th)	—	no fix	2023-03-06	≤ < 9.23.0
CVE-2025-30353US	high7.5	0.53% (44th)	—	11.5.0	2025-03-26	9.12.0, → 11.5.0
CVE-2024-39896US	medium5.3	0.51% (43rd)	—	10.13.0	2024-07-08	9.11, → 10.13.0
CVE-2023-38503US	medium6.5OT elevated	0.50% (43rd)	—	10.5.0	2023-07-25	10.3.0, → 10.5.0
CVE-2026-61836US	—	0.47% (41st)	—	no fix	2026-07-15	≤ < 12.0.0
CVE-2024-46990US	medium5.0	0.47% (40th)	—	11.1.0	2024-09-18	2 versions
CVE-2025-53886US	—	0.46% (40th)	—	11.9.0	2025-07-15	9.0.0, → 11.9.0
CVE-2025-53889US	—	0.46% (39th)	—	11.9.0	2025-07-15	9.12.0, → 11.9.0
CVE-2024-34709US	medium5.4	0.45% (39th)	—	10.11.0	2024-05-14	10.10.0, → 10.11.0
CVE-2025-30350US	—	0.44% (38th)	—	11.5.0	2025-03-26	9.22.0, → 11.5.0
CVE-2025-30225US	—	0.44% (38th)	—	11.5.0	2025-03-26	9.22.0, → 11.5.0
CVE-2024-39699US	medium5.0	0.43% (38th)	—	no fix	2024-07-08	≤ < 10.9.3
CVE-2024-39701US	high7.7	0.42% (36th)	—	10.6.0	2024-07-08	9.23.0, → 10.6.0
CVE-2026-10716US	—	0.42% (36th)	—	12.1.0	2026-08-05	0 → 12.1.0
CVE-2026-61835US	—	0.41% (35th)	—	no fix	2026-07-15	≤ < 12.0.0
CVE-2026-26185US	—	0.39% (33rd)	—	no fix	2026-02-12	≤ < 11.14.1
CVE-2025-24353US	medium4.3	0.39% (32nd)	—	no fix	2025-01-23	≤ < 11.2.0
CVE-2025-30352US	—	0.38% (31st)	—	11.5.0	2025-03-26	9.0.0-alpha.4, → 11.5.0
CVE-2025-30351US	medium4.3	0.37% (31st)	—	11.15.0	2025-03-26	2 versions
CVE-2026-35441US	—	0.36% (30th)	—	no fix	2026-04-06	≤ < 11.17.0
CVE-2025-64749US	—	0.35% (28th)	—	no fix	2025-11-13	≤ < 11.13.0
CVE-2024-54128US	medium4.6	0.34% (28th)	—	10.13.4	2024-12-05	2 versions
CVE-2026-35442US	—OT elevated	0.34% (27th)	—	no fix	2026-04-06	≤ < 11.17.0
CVE-2026-35409US	—	0.34% (27th)	—	no fix	2026-04-06	≤ < 11.16.0
CVE-2026-35413US	—	0.31% (24th)	—	no fix	2026-04-06	≤ < 11.16.1
CVE-2023-28443US	medium5.5	0.31% (24th)	—	no fix	2023-03-24	≤ < 9.23.3
CVE-2024-47822US	medium4.2	0.31% (24th)	—	no fix	2024-10-08	≤ < 10.13.2
CVE-2026-35412US	high8.1OT elevated	0.30% (23rd)	—	no fix	2026-04-06	≤ < 11.16.1
CVE-2025-64748US	—	0.30% (22nd)	—	no fix	2025-11-13	≤ < 11.13.0
CVE-2025-64747US	—	0.26% (18th)	—	no fix	2025-11-13	≤ < 11.13.0
CVE-2026-35411US	—	0.26% (17th)	—	no fix	2026-04-06	≤ < 11.16.1
CVE-2026-35410US	—	0.26% (17th)	—	no fix	2026-04-06	≤ < 11.16.1

showing 50 of 58

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor14 CVEs
CWE-918Server-Side Request Forgery (SSRF)6 CVEs
CWE-284Improper Access Control5 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5 CVEs
CWE-863Incorrect Authorization5 CVEs
CWE-532Insertion of Sensitive Information into Log File4 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')4 CVEs
CWE-20Improper Input Validation3 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)58 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan