{"schema_version":1,"title":"@directus/api (npm) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 13 vulnerabilities in @directus/api (npm): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-26185, was published on 12 February 2026.","url":"https://junglewise.ai/threats/technologies/directus-api","json_url":"https://junglewise.ai/threats/technologies/directus-api.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/directus-api","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":0,"all_time":13,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":4},"latest":[{"cve":"CVE-2026-26185","cvss":3.1,"epss":0.0043,"slug":"cve-2026-26185-directus-user-enumeration-via-password-reset-timing-attack","title":"Directus user enumeration via password reset timing attack","severity":"low","exploited":false,"published_at":"2026-02-12T22:13:04+00:00","url":"https://junglewise.ai/threats/cve-2026-26185-directus-user-enumeration-via-password-reset-timing-attack"},{"cve":"CVE-2026-22032","cvss":3.1,"epss":0.0023,"slug":"cve-2026-22032-directus-open-redirect-in-saml-authentication-callback","title":"Directus open redirect in SAML authentication","severity":"low","exploited":false,"published_at":"2026-01-06T19:22:38+00:00","url":"https://junglewise.ai/threats/cve-2026-22032-directus-open-redirect-in-saml-authentication-callback"},{"cve":"CVE-2025-64749","cvss":3.1,"epss":0.0033,"slug":"cve-2025-64749-directus-information-leakage-in-rest-api-error-messages","title":"Directus information leakage in REST API error messages","severity":"low","exploited":false,"published_at":"2025-11-13T23:07:31+00:00","url":"https://junglewise.ai/threats/cve-2025-64749-directus-information-leakage-in-rest-api-error-messages"},{"cve":"CVE-2025-64748","cvss":3.1,"epss":0.0028,"slug":"cve-2025-64748-directus-concealed-fields-information-disclosure-via-search","title":"Directus concealed fields information disclosure via search","severity":"low","exploited":false,"published_at":"2025-11-13T23:06:41+00:00","url":"https://junglewise.ai/threats/cve-2025-64748-directus-concealed-fields-information-disclosure-via-search"},{"cve":"CVE-2025-55746","cvss":3.1,"epss":0.0133,"slug":"cve-2025-55746-directus-unauthenticated-file-upload-and-modification","title":"Directus unauthenticated file upload and modification","severity":"low","exploited":false,"published_at":"2025-08-20T19:08:20+00:00","url":"https://junglewise.ai/threats/cve-2025-55746-directus-unauthenticated-file-upload-and-modification"},{"cve":"CVE-2024-47822","cvss":3.1,"epss":0.0031,"slug":"cve-2024-47822-directus-access-token-exposure-in-logs","title":"Directus access token exposure in logs","severity":"low","exploited":false,"published_at":"2025-04-14T15:20:40+00:00","url":"https://junglewise.ai/threats/cve-2024-47822-directus-access-token-exposure-in-logs"},{"cve":"CVE-2025-30351","cvss":3.1,"epss":0.0036,"slug":"cve-2025-30351-directus-suspended-user-session-token-bypass","title":"Directus suspended user session token bypass","severity":"low","exploited":false,"published_at":"2025-03-26T18:30:43+00:00","url":"https://junglewise.ai/threats/cve-2025-30351-directus-suspended-user-session-token-bypass"},{"cve":"CVE-2025-27089","cvss":3.1,"epss":0.0024,"slug":"cve-2025-27089-directus-authorization-bypass-in-overlapping-update-policies","title":"Directus authorization bypass in overlapping update policies","severity":"low","exploited":false,"published_at":"2025-02-19T17:46:27+00:00","url":"https://junglewise.ai/threats/cve-2025-27089-directus-authorization-bypass-in-overlapping-update-policies"},{"cve":"CVE-2024-54151","cvss":3.1,"epss":0.006,"slug":"cve-2024-54151-directus-unauthenticated-websocket-access-to-crud-operations","title":"Directus unauthenticated WebSocket access to CRUD operations","severity":"low","exploited":false,"published_at":"2024-12-09T20:40:54+00:00","url":"https://junglewise.ai/threats/cve-2024-54151-directus-unauthenticated-websocket-access-to-crud-operations"},{"cve":"CVE-2024-46990","cvss":3.1,"epss":0.0047,"slug":"cve-2024-46990-directus-ssrf-loopback-ip-filter-bypass","title":"Directus SSRF loopback IP filter bypass","severity":"low","exploited":false,"published_at":"2024-09-18T17:42:05+00:00","url":"https://junglewise.ai/threats/cve-2024-46990-directus-ssrf-loopback-ip-filter-bypass"},{"cve":"CVE-2024-45596","cvss":3.1,"epss":0.0066,"slug":"cve-2024-45596-directus-session-caching-vulnerability-in-openid-and-oauth2","title":"Directus session caching vulnerability in OpenID and OAuth2","severity":"low","exploited":false,"published_at":"2024-09-10T19:43:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45596-directus-session-caching-vulnerability-in-openid-and-oauth2"},{"cve":"CVE-2024-39699","cvss":3.1,"epss":0.0044,"slug":"cve-2024-39699-directus-blind-ssrf-via-file-import-redirect-bypass","title":"Directus blind SSRF via file import redirect bypass","severity":"low","exploited":false,"published_at":"2024-07-08T15:25:50+00:00","url":"https://junglewise.ai/threats/cve-2024-39699-directus-blind-ssrf-via-file-import-redirect-bypass"},{"cve":"CVE-2020-19850","cvss":3.1,"slug":"cve-2020-19850-directus-api-denial-of-service-via-resource-exhaustion","title":"Directus API denial of service via resource exhaustion","severity":"low","exploited":false,"published_at":"2023-04-04T15:30:27+00:00","url":"https://junglewise.ai/threats/cve-2020-19850-directus-api-denial-of-service-via-resource-exhaustion"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"flowise (npm)","slug":"flowise","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/flowise"},{"name":"vm2 (npm)","slug":"vm2","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/vm2"},{"name":"@budibase/server (npm)","slug":"budibase-server","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/budibase-server"},{"name":"directus (npm)","slug":"directus","vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/directus"},{"name":"nocodb (npm)","slug":"nocodb","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/nocodb"},{"name":"hono (npm)","slug":"hono","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/hono"},{"name":"parse-server (npm)","slug":"parse-server","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/parse-server"},{"name":"dompurify (npm)","slug":"dompurify","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/dompurify"},{"name":"ghost (npm)","slug":"ghost","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/ghost"},{"name":"flowise-components (npm)","slug":"flowise-components","vulnerabilities":35,"url":"https://junglewise.ai/threats/technologies/flowise-components"},{"name":"astro (npm)","slug":"astro","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/astro"},{"name":"@anthropic-ai/claude-code (npm)","slug":"anthropic-ai-claude-code","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/anthropic-ai-claude-code"}],"technology":{"hub":true,"name":"@directus/api (npm)","slug":"directus-api","vendor":{"name":"npm","slug":"npm","url":"https://junglewise.ai/threats/vendors/npm"},"aliases":[],"homepage":"https://directus.io/","repo_url":"https://github.com/directus/directus","description":"The core API engine for the Directus headless CMS.","url":"https://junglewise.ai/threats/technologies/directus-api"},"most_severe":[{"cve":"CVE-2025-55746","cvss":3.1,"epss":0.0133,"slug":"cve-2025-55746-directus-unauthenticated-file-upload-and-modification","title":"Directus unauthenticated file upload and modification","severity":"low","exploited":false,"published_at":"2025-08-20T19:08:20+00:00","url":"https://junglewise.ai/threats/cve-2025-55746-directus-unauthenticated-file-upload-and-modification"},{"cve":"CVE-2024-45596","cvss":3.1,"epss":0.0066,"slug":"cve-2024-45596-directus-session-caching-vulnerability-in-openid-and-oauth2","title":"Directus session caching vulnerability in OpenID and OAuth2","severity":"low","exploited":false,"published_at":"2024-09-10T19:43:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45596-directus-session-caching-vulnerability-in-openid-and-oauth2"},{"cve":"CVE-2024-54151","cvss":3.1,"epss":0.006,"slug":"cve-2024-54151-directus-unauthenticated-websocket-access-to-crud-operations","title":"Directus unauthenticated WebSocket access to CRUD operations","severity":"low","exploited":false,"published_at":"2024-12-09T20:40:54+00:00","url":"https://junglewise.ai/threats/cve-2024-54151-directus-unauthenticated-websocket-access-to-crud-operations"},{"cve":"CVE-2024-46990","cvss":3.1,"epss":0.0047,"slug":"cve-2024-46990-directus-ssrf-loopback-ip-filter-bypass","title":"Directus SSRF loopback IP filter bypass","severity":"low","exploited":false,"published_at":"2024-09-18T17:42:05+00:00","url":"https://junglewise.ai/threats/cve-2024-46990-directus-ssrf-loopback-ip-filter-bypass"},{"cve":"CVE-2024-39699","cvss":3.1,"epss":0.0044,"slug":"cve-2024-39699-directus-blind-ssrf-via-file-import-redirect-bypass","title":"Directus blind SSRF via file import redirect bypass","severity":"low","exploited":false,"published_at":"2024-07-08T15:25:50+00:00","url":"https://junglewise.ai/threats/cve-2024-39699-directus-blind-ssrf-via-file-import-redirect-bypass"},{"cve":"CVE-2026-26185","cvss":3.1,"epss":0.0043,"slug":"cve-2026-26185-directus-user-enumeration-via-password-reset-timing-attack","title":"Directus user enumeration via password reset timing attack","severity":"low","exploited":false,"published_at":"2026-02-12T22:13:04+00:00","url":"https://junglewise.ai/threats/cve-2026-26185-directus-user-enumeration-via-password-reset-timing-attack"},{"cve":"CVE-2025-30351","cvss":3.1,"epss":0.0036,"slug":"cve-2025-30351-directus-suspended-user-session-token-bypass","title":"Directus suspended user session token bypass","severity":"low","exploited":false,"published_at":"2025-03-26T18:30:43+00:00","url":"https://junglewise.ai/threats/cve-2025-30351-directus-suspended-user-session-token-bypass"},{"cve":"CVE-2025-64749","cvss":3.1,"epss":0.0033,"slug":"cve-2025-64749-directus-information-leakage-in-rest-api-error-messages","title":"Directus information leakage in REST API error messages","severity":"low","exploited":false,"published_at":"2025-11-13T23:07:31+00:00","url":"https://junglewise.ai/threats/cve-2025-64749-directus-information-leakage-in-rest-api-error-messages"},{"cve":"CVE-2024-47822","cvss":3.1,"epss":0.0031,"slug":"cve-2024-47822-directus-access-token-exposure-in-logs","title":"Directus access token exposure in logs","severity":"low","exploited":false,"published_at":"2025-04-14T15:20:40+00:00","url":"https://junglewise.ai/threats/cve-2024-47822-directus-access-token-exposure-in-logs"},{"cve":"CVE-2025-64748","cvss":3.1,"epss":0.0028,"slug":"cve-2025-64748-directus-concealed-fields-information-disclosure-via-search","title":"Directus concealed fields information disclosure via search","severity":"low","exploited":false,"published_at":"2025-11-13T23:06:41+00:00","url":"https://junglewise.ai/threats/cve-2025-64748-directus-concealed-fields-information-disclosure-via-search"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}