https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 11:40:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-225361 EUVD-2026-225361 https://cve.radiocsirt.org/vuln/euvd-2026-225361 https://cve.radiocsirt.org/vuln/fkie_cve-2025-30353 <p>Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the &#34;Webhook&#34; trigger and the &#34;Data of Last Operation&#34; response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.</p> <p>Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the &#34;Webhook&#34; trigger and the &#34;Data of Last Operation&#34; response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-30353 https://cve.radiocsirt.org/vuln/ghsa-fm3h-p9wm-h74h <p><strong>Affected:</strong> npm: directus</p> <p>### Describe the Bug</p> <p>In Directus, when a **Flow** with the &#34;_Webhook_&#34; trigger and the &#34;_Data of Last Operation_&#34; response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data.</p> <p>This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse.</p> <p>  </p> <p>### To Reproduce</p> <p>**Steps to Reproduce:** 1. Create a Flow in Directus with: - Trigger: Webhook - Response Body: Data of Last Operation 2. Add a condition that is likely to fail. 3. Trigger the Flow with any input data that will fail the condition. 4. Observe the API response, which includes sensitive information like: - Environmental variables (`$env`) - Authorization headers - User details under `$accountability` - Previous operational data.</p> <p>**Expected Behavior:** In the event of a ValidationError, the API response should only contain relevant error messages and details, avoiding the exposure of sensitive data.</p> <p>**Actual Behavior:** The API response includes sensitive information such as: - Environment keys (`FLOWS_ENV_AL…</p> <p><strong>Affected:</strong> npm: directus</p> <p>### Describe the Bug</p> <p>In Directus, when a **Flow** with the &#34;_Webhook_&#34; trigger and the &#34;_Data of Last Operation_&#34; response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data.</p> <p>This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse.</p> <p>  </p> <p>### To Reproduce</p> <p>**Steps to Reproduce:** 1. Create a Flow in Directus with: - Trigger: Webhook - Response Body: Data of Last Operation 2. Add a condition that is likely to fail. 3. Trigger the Flow with any input data that will fail the condition. 4. Observe the API response, which includes sensitive information like: - Environmental variables (`$env`) - Authorization headers - User details under `$accountability` - Previous operational data.</p> <p>**Expected Behavior:** In the event of a ValidationError, the API response should only contain relevant error messages and details, avoiding the exposure of sensitive data.</p> <p>**Actual Behavior:** The API response includes sensitive information such as: - Environment keys (`FLOWS_ENV_AL…</p> https://cve.radiocsirt.org/vuln/ghsa-fm3h-p9wm-h74h