monospace kayıtları
monospace üreticisine ait 56 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 0
- Düzeltme kaydı olan
- %100
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor14
- CWE-284 Improper Access Control5
- CWE-918 Server-Side Request Forgery (SSRF)4
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')3
- CWE-400 Uncontrolled Resource Consumption3
- CWE-203 Observable Discrepancy2
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
56 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
39İzleyin | CVE-2022-26969İstismar yok | In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.monospace · directus · CWE-942 | Kritik9,8 | — | %0,9 | 26 Ara 2022 |
37İzleyin | CVE-2026-35408İstismar yok | Directus is Missing Cross-Origin Opener Policymonospace · directus · CWE-346 | Kritik9,3 | — | %0,2 | 6 Nis 2026 |
35İzleyin | CVE-2026-39942İstismar yok | Directus has a Path Traversal and Broken Access Control in File Management APImonospace · directus · CWE-284 | Yüksek8,8 | — | %0,4 | 9 Nis 2026 |
34İzleyin | CVE-2026-61836İstismar yok | Directus: Authorization-dependent response served from unsegmented cache keymonospace · directus · CWE-524 | Yüksek8,6 | — | %0,5 | 15 Tem 2026 |
32İzleyin | CVE-2024-27295İstismar yok | Directus MySQL accent insensitive email matchingmonospace · directus · CWE-706 | Yüksek8,2 | — | %0,7 | 1 Mar 2024 |
32İzleyin | CVE-2026-35442İstismar yok | Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queriesmonospace · directus · CWE-200 | Yüksek8,1 | — | %0,4 | 6 Nis 2026 |
32İzleyin | CVE-2026-35412İstismar yok | Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwritemonospace · directus · CWE-863 | Yüksek8,1 | — | %0,4 | 6 Nis 2026 |
30İzleyin | CVE-2025-55746Kavram kanıtı | Directus allows unauthenticated file upload and file modification due to lacking input sanitizationmonospace · directus · CWE-73 | Yüksek7,5 | — | %1,3 | 20 Ağu 2025 |
30İzleyin | CVE-2023-26492İstismar yok | Directus vulnerable to Server-Side Request Forgery On File Importmonospace · directus · CWE-918 | Yüksek7,5 | — | %1,0 | 3 Mar 2023 |
30İzleyin | CVE-2024-36128İstismar yok | Directus is soft-locked by providing a string value to random string utilmonospace · directus · CWE-754 | Yüksek7,5 | — | %0,6 | 3 Haz 2024 |
30İzleyin | CVE-2024-54151İstismar yok | Directus allows unauthenticated access to WebSocket events and operationsmonospace · directus · CWE-200 | Yüksek7,5 | — | %0,6 | 9 Ara 2024 |
30İzleyin | CVE-2025-30353İstismar yok | Directus's webhook trigger flows can leak sensitive datamonospace · directus · CWE-200 | Yüksek7,5 | — | %0,5 | 26 Mar 2025 |
30İzleyin | CVE-2024-39701İstismar yok | Directus Incorrectly handles _in` filtermonospace · directus · CWE-284 | Yüksek7,7 | — | %0,4 | 8 Tem 2024 |
30İzleyin | CVE-2026-61835İstismar yok | Directus: SSRF Protection Bypass via 0.0.0.0 in File Importmonospace · directus · CWE-918 | Yüksek7,7 | — | %0,4 | 15 Tem 2026 |
30İzleyin | CVE-2026-35409İstismar yok | Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Importmonospace · directus · CWE-918 | Yüksek7,7 | — | %0,4 | 6 Nis 2026 |
26İzleyin | CVE-2020-19850İstismar yok | An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.monospace · directus · CWE-400 | Orta6,5 | — | %1,1 | 4 Nis 2023 |
26İzleyin | CVE-2022-36031İstismar yok | Unhandled exception on illegal filename_disk valuemonospace · directus · CWE-755 | Orta6,5 | — | %1,0 | 19 Ağu 2022 |
26İzleyin | CVE-2024-39895İstismar yok | Directus GraphQL Field Duplication Denial of Service (DoS)monospace · directus · CWE-400 | Orta6,5 | — | %0,8 | 8 Tem 2024 |
26İzleyin | CVE-2023-45820İstismar yok | Directus crashes on invalid WebSocket messagemonospace · directus · CWE-755 | Orta6,5 | — | %0,7 | 19 Eki 2023 |
26İzleyin | CVE-2024-45596İstismar yok | Directus's session is cached for OpenID and OAuth2 if `redirect` is not usedmonospace · directus · CWE-524 | Orta6,5 | — | %0,7 | 10 Eyl 2024 |
26İzleyin | CVE-2023-38503İstismar yok | Directus has Incorrect Permission Checking for GraphQL Subscriptionsmonospace · directus · CWE-200 | Orta6,5 | — | %0,5 | 25 Tem 2023 |
26İzleyin | CVE-2026-35441İstismar yok | Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limitsmonospace · directus · CWE-400 | Orta6,5 | — | %0,4 | 6 Nis 2026 |
26İzleyin | CVE-2025-53889İstismar yok | Directus missing permission checks for manual trigger Flowsmonospace · directus · CWE-287 | Orta6,5 | — | %0,4 | 14 Tem 2025 |
26İzleyin | CVE-2025-64748İstismar yok | Directus's conceal fields are searchable if read permissions enabledmonospace · directus · CWE-201 | Orta6,5 | — | %0,3 | 13 Kas 2025 |
26İzleyin | CVE-2026-39943İstismar yok | Directus exposes sensitive fields in revision historymonospace · directus · CWE-200 | Orta6,5 | — | %0,3 | 9 Nis 2026 |
- CVE-2022-2696939İzleyin
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
KritikCVSS 9,8İstismar yokEPSS %1monospace · directus26 Ara 2022
- CVE-2026-3540837İzleyin
Directus is Missing Cross-Origin Opener Policy
KritikCVSS 9,3İstismar yokEPSS %0monospace · directus6 Nis 2026
- CVE-2026-3994235İzleyin
Directus has a Path Traversal and Broken Access Control in File Management API
YüksekCVSS 8,8İstismar yokEPSS %0monospace · directus9 Nis 2026
- CVE-2026-6183634İzleyin
Directus: Authorization-dependent response served from unsegmented cache key
YüksekCVSS 8,6İstismar yokEPSS %0monospace · directus15 Tem 2026
- CVE-2024-2729532İzleyin
Directus MySQL accent insensitive email matching
YüksekCVSS 8,2İstismar yokEPSS %1monospace · directus1 Mar 2024
- CVE-2026-3544232İzleyin
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
YüksekCVSS 8,1İstismar yokEPSS %0monospace · directus6 Nis 2026
- CVE-2026-3541232İzleyin
Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
YüksekCVSS 8,1İstismar yokEPSS %0monospace · directus6 Nis 2026
- CVE-2025-5574630İzleyin
Directus allows unauthenticated file upload and file modification due to lacking input sanitization
YüksekCVSS 7,5Kavram kanıtıEPSS %1monospace · directus20 Ağu 2025
- CVE-2023-2649230İzleyin
Directus vulnerable to Server-Side Request Forgery On File Import
YüksekCVSS 7,5İstismar yokEPSS %1monospace · directus3 Mar 2023
- CVE-2024-3612830İzleyin
Directus is soft-locked by providing a string value to random string util
YüksekCVSS 7,5İstismar yokEPSS %1monospace · directus3 Haz 2024
- CVE-2024-5415130İzleyin
Directus allows unauthenticated access to WebSocket events and operations
YüksekCVSS 7,5İstismar yokEPSS %1monospace · directus9 Ara 2024
- CVE-2025-3035330İzleyin
Directus's webhook trigger flows can leak sensitive data
YüksekCVSS 7,5İstismar yokEPSS %1monospace · directus26 Mar 2025
- CVE-2024-3970130İzleyin
Directus Incorrectly handles _in` filter
YüksekCVSS 7,7İstismar yokEPSS %0monospace · directus8 Tem 2024
- CVE-2026-6183530İzleyin
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
YüksekCVSS 7,7İstismar yokEPSS %0monospace · directus15 Tem 2026
- CVE-2026-3540930İzleyin
Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
YüksekCVSS 7,7İstismar yokEPSS %0monospace · directus6 Nis 2026
- CVE-2020-1985026İzleyin
An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.
OrtaCVSS 6,5İstismar yokEPSS %1monospace · directus4 Nis 2023
- CVE-2022-3603126İzleyin
Unhandled exception on illegal filename_disk value
OrtaCVSS 6,5İstismar yokEPSS %1monospace · directus19 Ağu 2022
- CVE-2024-3989526İzleyin
Directus GraphQL Field Duplication Denial of Service (DoS)
OrtaCVSS 6,5İstismar yokEPSS %1monospace · directus8 Tem 2024
- CVE-2023-4582026İzleyin
Directus crashes on invalid WebSocket message
OrtaCVSS 6,5İstismar yokEPSS %1monospace · directus19 Eki 2023
- CVE-2024-4559626İzleyin
Directus's session is cached for OpenID and OAuth2 if `redirect` is not used
OrtaCVSS 6,5İstismar yokEPSS %1monospace · directus10 Eyl 2024
- CVE-2023-3850326İzleyin
Directus has Incorrect Permission Checking for GraphQL Subscriptions
OrtaCVSS 6,5İstismar yokEPSS %0monospace · directus25 Tem 2023
- CVE-2026-3544126İzleyin
Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits
OrtaCVSS 6,5İstismar yokEPSS %0monospace · directus6 Nis 2026
- CVE-2025-5388926İzleyin
Directus missing permission checks for manual trigger Flows
OrtaCVSS 6,5İstismar yokEPSS %0monospace · directus14 Tem 2025
- CVE-2025-6474826İzleyin
Directus's conceal fields are searchable if read permissions enabled
OrtaCVSS 6,5İstismar yokEPSS %0monospace · directus13 Kas 2025
- CVE-2026-3994326İzleyin
Directus exposes sensitive fields in revision history
OrtaCVSS 6,5İstismar yokEPSS %0monospace · directus9 Nis 2026