# directus (npm) vulnerabilities Source: https://junglewise.ai/threats/technologies/directus Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/directus.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 61 vulnerabilities in directus (npm): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-61836, was published on 15 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 61 (0 critical, 0 exploited in the wild) ## About directus (npm) Directus is a headless CMS and API-first database content management platform. ## Latest directus (npm) vulnerabilities - [CVE-2026-61836: Directus authorization bypass via unsegmented response cache key](https://junglewise.ai/threats/cve-2026-61836-directus-authorization-bypass-via-unsegmented-response-cache-key) (high, CVSS 8.6, published 15 Jul 2026) - [CVE-2026-61835: Directus SSRF bypass in file import via 0.0.0.0 address](https://junglewise.ai/threats/cve-2026-61835-directus-ssrf-bypass-in-file-import-via-0-0-0-0-address) (high, CVSS 7.7, published 15 Jul 2026) - [CVE-2026-35442: Directus sensitive information disclosure via aggregate queries](https://junglewise.ai/threats/cve-2026-35442-directus-sensitive-information-disclosure-via-aggregate-queries) (high, CVSS 8.1, published 6 Apr 2026) - [CVE-2026-35441: Directus resource exhaustion via GraphQL alias amplification](https://junglewise.ai/threats/cve-2026-35441-directus-resource-exhaustion-via-graphql-alias-amplification) (medium, CVSS 6.5, published 6 Apr 2026) - [CVE-2026-35413: Directus GraphQL introspection bypass in system endpoint](https://junglewise.ai/threats/cve-2026-35413-directus-graphql-introspection-bypass-in-system-endpoint) (medium, CVSS 5.3, published 6 Apr 2026) - [CVE-2026-35412: Directus authorization bypass in TUS resumable upload endpoint](https://junglewise.ai/threats/cve-2026-35412-directus-authorization-bypass-in-tus-resumable-upload-endpoint) (high, CVSS 7.1, published 6 Apr 2026) - [CVE-2026-35411: Directus open redirect in 2FA setup page](https://junglewise.ai/threats/cve-2026-35411-directus-open-redirect-in-2fa-setup-page) (medium, CVSS 4.3, published 6 Apr 2026) - [CVE-2026-35410: Directus open redirect in login redirection logic](https://junglewise.ai/threats/cve-2026-35410-directus-open-redirect-in-login-redirection-logic) (medium, CVSS 6.1, published 6 Apr 2026) - [CVE-2026-35409: Directus SSRF protection bypass in File Import](https://junglewise.ai/threats/cve-2026-35409-directus-ssrf-protection-bypass-in-file-import) (high, CVSS 7.7, published 6 Apr 2026) - [CVE-2026-35408: Directus account takeover via missing COOP header in SSO login](https://junglewise.ai/threats/cve-2026-35408-directus-account-takeover-via-missing-coop-header-in-sso-login) (high, CVSS 8.7, published 6 Apr 2026) - [Directus unauthenticated denial of service via GraphQL alias amplification](https://junglewise.ai/threats/directus-unauthenticated-denial-of-service-via-graphql-alias-a0cc9ef0) (low, CVSS 3.1, published 4 Apr 2026) - [CVE-2026-39943: Directus sensitive fields exposed in revision history](https://junglewise.ai/threats/cve-2026-39943-directus-sensitive-fields-exposed-in-revision-history) (low, CVSS 3.1, published 4 Apr 2026) - [CVE-2026-39942: Directus broken access control in file management API](https://junglewise.ai/threats/cve-2026-39942-directus-path-traversal-and-broken-access-control-in-file) (low, CVSS 3.1, published 4 Apr 2026) - [CVE-2026-26185: Directus user enumeration via password reset timing attack](https://junglewise.ai/threats/cve-2026-26185-directus-user-enumeration-via-password-reset-timing-attack) (low, CVSS 3.1, published 12 Feb 2026) - [CVE-2026-22032: Directus open redirect in SAML authentication](https://junglewise.ai/threats/cve-2026-22032-directus-open-redirect-in-saml-authentication-callback) (low, CVSS 3.1, published 6 Jan 2026) - [CVE-2025-64749: Directus information leakage in REST API error messages](https://junglewise.ai/threats/cve-2025-64749-directus-information-leakage-in-rest-api-error-messages) (medium, CVSS 4.3, published 13 Nov 2025) - [CVE-2025-64748: Directus concealed fields information disclosure via search](https://junglewise.ai/threats/cve-2025-64748-directus-concealed-fields-information-disclosure-via-search) (medium, CVSS 6.5, published 13 Nov 2025) - [CVE-2025-64747: Directus stored cross-site scripting in Block Editor](https://junglewise.ai/threats/cve-2025-64747-directus-stored-cross-site-scripting-in-block-editor) (medium, CVSS 5.5, published 13 Nov 2025) - [CVE-2025-64746: Directus improper permission handling on deleted fields](https://junglewise.ai/threats/cve-2025-64746-directus-improper-permission-handling-on-deleted-fields) (medium, CVSS 4.6, published 13 Nov 2025) - [CVE-2025-55746: Directus unauthenticated file upload and modification](https://junglewise.ai/threats/cve-2025-55746-directus-unauthenticated-file-upload-and-modification) (low, CVSS 3.1, published 20 Aug 2025) - [CVE-2025-53889: Directus missing permission checks for manual trigger Flows](https://junglewise.ai/threats/cve-2025-53889-directus-missing-permission-checks-for-manual-trigger-flows) (low, CVSS 3.1, published 15 Jul 2025) - [CVE-2025-53887: Directus version number exposure in OpenAPI spec](https://junglewise.ai/threats/cve-2025-53887-directus-version-number-exposure-in-openapi-spec) (low, CVSS 3.1, published 15 Jul 2025) - [CVE-2025-53886: Directus Flows WebHook trigger token exposure in logs](https://junglewise.ai/threats/cve-2025-53886-directus-flows-webhook-trigger-token-exposure-in-logs) (low, CVSS 3.1, published 15 Jul 2025) - [CVE-2025-53885: Directus sensitive data exposure in event logging](https://junglewise.ai/threats/cve-2025-53885-directus-sensitive-data-exposure-in-event-logging) (low, CVSS 3.1, published 15 Jul 2025) - [CVE-2025-30353: Directus webhook trigger flows sensitive data leak](https://junglewise.ai/threats/cve-2025-30353-directus-webhook-trigger-flows-sensitive-data-leak) (low, CVSS 3.1, published 26 Mar 2025) ## Most severe directus (npm) vulnerabilities - [CVE-2026-35408: Directus account takeover via missing COOP header in SSO login](https://junglewise.ai/threats/cve-2026-35408-directus-account-takeover-via-missing-coop-header-in-sso-login) (high, CVSS 8.7, published 6 Apr 2026) - [CVE-2026-61836: Directus authorization bypass via unsegmented response cache key](https://junglewise.ai/threats/cve-2026-61836-directus-authorization-bypass-via-unsegmented-response-cache-key) (high, CVSS 8.6, published 15 Jul 2026) - [CVE-2026-35442: Directus sensitive information disclosure via aggregate queries](https://junglewise.ai/threats/cve-2026-35442-directus-sensitive-information-disclosure-via-aggregate-queries) (high, CVSS 8.1, published 6 Apr 2026) - [CVE-2026-61835: Directus SSRF bypass in file import via 0.0.0.0 address](https://junglewise.ai/threats/cve-2026-61835-directus-ssrf-bypass-in-file-import-via-0-0-0-0-address) (high, CVSS 7.7, published 15 Jul 2026) - [CVE-2026-35409: Directus SSRF protection bypass in File Import](https://junglewise.ai/threats/cve-2026-35409-directus-ssrf-protection-bypass-in-file-import) (high, CVSS 7.7, published 6 Apr 2026) - [CVE-2024-39896: Directus SSO user enumeration via error message disclosure](https://junglewise.ai/threats/cve-2024-39896-directus-sso-user-enumeration-via-error-message-disclosure) (high, CVSS 7.5, published 8 Jul 2024) - [CVE-2026-35412: Directus authorization bypass in TUS resumable upload endpoint](https://junglewise.ai/threats/cve-2026-35412-directus-authorization-bypass-in-tus-resumable-upload-endpoint) (high, CVSS 7.1, published 6 Apr 2026) - [CVE-2026-35441: Directus resource exhaustion via GraphQL alias amplification](https://junglewise.ai/threats/cve-2026-35441-directus-resource-exhaustion-via-graphql-alias-amplification) (medium, CVSS 6.5, published 6 Apr 2026) - [CVE-2025-64748: Directus concealed fields information disclosure via search](https://junglewise.ai/threats/cve-2025-64748-directus-concealed-fields-information-disclosure-via-search) (medium, CVSS 6.5, published 13 Nov 2025) - [CVE-2026-35410: Directus open redirect in login redirection logic](https://junglewise.ai/threats/cve-2026-35410-directus-open-redirect-in-login-redirection-logic) (medium, CVSS 6.1, published 6 Apr 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other npm technologies - [openclaw (npm)](https://junglewise.ai/threats/technologies/npm-openclaw): 214 vulnerabilities - [flowise (npm)](https://junglewise.ai/threats/technologies/flowise): 133 vulnerabilities - [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server): 117 vulnerabilities - [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2): 111 vulnerabilities - [electron (npm)](https://junglewise.ai/threats/technologies/electron): 77 vulnerabilities - [ghost (npm)](https://junglewise.ai/threats/technologies/ghost): 74 vulnerabilities - [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n): 64 vulnerabilities - [hono (npm)](https://junglewise.ai/threats/technologies/hono): 62 vulnerabilities - [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb): 54 vulnerabilities - [undici (npm)](https://junglewise.ai/threats/technologies/undici): 53 vulnerabilities - [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server): 42 vulnerabilities - [apostrophe (npm)](https://junglewise.ai/threats/technologies/apostrophe): 36 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "directus (npm) vulnerabilities", https://junglewise.ai/threats/technologies/directus, 13 November 2026.