monospace records

56 published records for vendor monospace.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

56 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2022-26969No exploit	In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.monospace · directus · CWE-942 Pre-auth	Critical9.8	—	0.9%	Dec 26, 2022
37Monitor	CVE-2026-35408No exploit	Directus is Missing Cross-Origin Opener Policymonospace · directus · CWE-346 Pre-auth	Critical9.3	—	0.2%	Apr 6, 2026
35Monitor	CVE-2026-39942No exploit	Directus has a Path Traversal and Broken Access Control in File Management APImonospace · directus · CWE-284 Path traversal Broken access control (IDOR)	High8.8	—	0.4%	Apr 9, 2026
34Monitor	CVE-2026-61836No exploit	Directus: Authorization-dependent response served from unsegmented cache keymonospace · directus · CWE-524 Pre-auth	High8.6	—	0.5%	Jul 15, 2026
32Monitor	CVE-2024-27295No exploit	Directus MySQL accent insensitive email matchingmonospace · directus · CWE-706 Pre-auth	High8.2	—	0.7%	Mar 1, 2024
32Monitor	CVE-2026-35442No exploit	Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queriesmonospace · directus · CWE-200 Info leak	High8.1	—	0.4%	Apr 6, 2026
32Monitor	CVE-2026-35412No exploit	Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwritemonospace · directus · CWE-863 Broken access control (IDOR)	High8.1	—	0.4%	Apr 6, 2026
30Monitor	CVE-2025-55746Proof of concept	Directus allows unauthenticated file upload and file modification due to lacking input sanitizationmonospace · directus · CWE-73 Pre-auth Path traversal	High7.5	—	1.3%	Aug 20, 2025
30Monitor	CVE-2023-26492No exploit	Directus vulnerable to Server-Side Request Forgery On File Importmonospace · directus · CWE-918 Pre-auth SSRF	High7.5	—	1.0%	Mar 3, 2023
30Monitor	CVE-2024-36128No exploit	Directus is soft-locked by providing a string value to random string utilmonospace · directus · CWE-754 Pre-auth Denial of service	High7.5	—	0.6%	Jun 3, 2024
30Monitor	CVE-2024-54151No exploit	Directus allows unauthenticated access to WebSocket events and operationsmonospace · directus · CWE-200 Pre-auth Auth bypass Info leak	High7.5	—	0.6%	Dec 9, 2024
30Monitor	CVE-2025-30353No exploit	Directus's webhook trigger flows can leak sensitive datamonospace · directus · CWE-200 Pre-auth Info leak	High7.5	—	0.5%	Mar 26, 2025
30Monitor	CVE-2024-39701No exploit	Directus Incorrectly handles _in` filtermonospace · directus · CWE-284 Broken access control (IDOR)	High7.7	—	0.4%	Jul 8, 2024
30Monitor	CVE-2026-61835No exploit	Directus: SSRF Protection Bypass via 0.0.0.0 in File Importmonospace · directus · CWE-918 SSRF	High7.7	—	0.4%	Jul 15, 2026
30Monitor	CVE-2026-35409No exploit	Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Importmonospace · directus · CWE-918 SSRF	High7.7	—	0.4%	Apr 6, 2026
26Monitor	CVE-2020-19850No exploit	An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.monospace · directus · CWE-400 Denial of service	Medium6.5	—	1.1%	Apr 4, 2023
26Monitor	CVE-2022-36031No exploit	Unhandled exception on illegal filename_disk valuemonospace · directus · CWE-755 Denial of service	Medium6.5	—	1.0%	Aug 19, 2022
26Monitor	CVE-2024-39895No exploit	Directus GraphQL Field Duplication Denial of Service (DoS)monospace · directus · CWE-400 Denial of service	Medium6.5	—	0.8%	Jul 8, 2024
26Monitor	CVE-2023-45820No exploit	Directus crashes on invalid WebSocket messagemonospace · directus · CWE-755 Denial of service	Medium6.5	—	0.7%	Oct 19, 2023
26Monitor	CVE-2024-45596No exploit	Directus's session is cached for OpenID and OAuth2 if `redirect` is not usedmonospace · directus · CWE-524 Pre-auth	Medium6.5	—	0.7%	Sep 10, 2024
26Monitor	CVE-2023-38503No exploit	Directus has Incorrect Permission Checking for GraphQL Subscriptionsmonospace · directus · CWE-200 Info leak	Medium6.5	—	0.5%	Jul 25, 2023
26Monitor	CVE-2026-35441No exploit	Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limitsmonospace · directus · CWE-400 Denial of service	Medium6.5	—	0.4%	Apr 6, 2026
26Monitor	CVE-2025-53889No exploit	Directus missing permission checks for manual trigger Flowsmonospace · directus · CWE-287 Pre-auth Auth bypass	Medium6.5	—	0.4%	Jul 14, 2025
26Monitor	CVE-2025-64748No exploit	Directus's conceal fields are searchable if read permissions enabledmonospace · directus · CWE-201	Medium6.5	—	0.3%	Nov 13, 2025
26Monitor	CVE-2026-39943No exploit	Directus exposes sensitive fields in revision historymonospace · directus · CWE-200 Info leak	Medium6.5	—	0.3%	Apr 9, 2026

CVE-2022-26969
39Monitor
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
monospace · directusDec 26, 2022
CVE-2026-35408
37Monitor
Directus is Missing Cross-Origin Opener Policy
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
monospace · directusApr 6, 2026
CVE-2026-39942
35Monitor
Directus has a Path Traversal and Broken Access Control in File Management API
HighCVSS 8.8No exploitEPSS 0%
- Path traversal
- Broken access control (IDOR)
monospace · directusApr 9, 2026
CVE-2026-61836
34Monitor
Directus: Authorization-dependent response served from unsegmented cache key
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
monospace · directusJul 15, 2026
CVE-2024-27295
32Monitor
Directus MySQL accent insensitive email matching
HighCVSS 8.2No exploitEPSS 1%
- Pre-auth
monospace · directusMar 1, 2024
CVE-2026-35442
32Monitor
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
HighCVSS 8.1No exploitEPSS 0%
- Info leak
monospace · directusApr 6, 2026
CVE-2026-35412
32Monitor
Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
monospace · directusApr 6, 2026
CVE-2025-55746
30Monitor
Directus allows unauthenticated file upload and file modification due to lacking input sanitization
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
monospace · directusAug 20, 2025
CVE-2023-26492
30Monitor
Directus vulnerable to Server-Side Request Forgery On File Import
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- SSRF
monospace · directusMar 3, 2023
CVE-2024-36128
30Monitor
Directus is soft-locked by providing a string value to random string util
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
monospace · directusJun 3, 2024
CVE-2024-54151
30Monitor
Directus allows unauthenticated access to WebSocket events and operations
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Auth bypass
- Info leak
monospace · directusDec 9, 2024
CVE-2025-30353
30Monitor
Directus's webhook trigger flows can leak sensitive data
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Info leak
monospace · directusMar 26, 2025
CVE-2024-39701
30Monitor
Directus Incorrectly handles _in` filter
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
monospace · directusJul 8, 2024
CVE-2026-61835
30Monitor
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
HighCVSS 7.7No exploitEPSS 0%
- SSRF
monospace · directusJul 15, 2026
CVE-2026-35409
30Monitor
Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
HighCVSS 7.7No exploitEPSS 0%
- SSRF
monospace · directusApr 6, 2026
CVE-2020-19850
26Monitor
An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.
MediumCVSS 6.5No exploitEPSS 1%
- Denial of service
monospace · directusApr 4, 2023
CVE-2022-36031
26Monitor
Unhandled exception on illegal filename_disk value
MediumCVSS 6.5No exploitEPSS 1%
- Denial of service
monospace · directusAug 19, 2022
CVE-2024-39895
26Monitor
Directus GraphQL Field Duplication Denial of Service (DoS)
MediumCVSS 6.5No exploitEPSS 1%
- Denial of service
monospace · directusJul 8, 2024
CVE-2023-45820
26Monitor
Directus crashes on invalid WebSocket message
MediumCVSS 6.5No exploitEPSS 1%
- Denial of service
monospace · directusOct 19, 2023
CVE-2024-45596
26Monitor
Directus's session is cached for OpenID and OAuth2 if `redirect` is not used
MediumCVSS 6.5No exploitEPSS 1%
- Pre-auth
monospace · directusSep 10, 2024
CVE-2023-38503
26Monitor
Directus has Incorrect Permission Checking for GraphQL Subscriptions
MediumCVSS 6.5No exploitEPSS 0%
- Info leak
monospace · directusJul 25, 2023
CVE-2026-35441
26Monitor
Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits
MediumCVSS 6.5No exploitEPSS 0%
- Denial of service
monospace · directusApr 6, 2026
CVE-2025-53889
26Monitor
Directus missing permission checks for manual trigger Flows
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
monospace · directusJul 14, 2025
CVE-2025-64748
26Monitor
Directus's conceal fields are searchable if read permissions enabled
MediumCVSS 6.5No exploitEPSS 0%
monospace · directusNov 13, 2025
CVE-2026-39943
26Monitor
Directus exposes sensitive fields in revision history
MediumCVSS 6.5No exploitEPSS 0%
- Info leak
monospace · directusApr 9, 2026