Advisories · Technology
twenty.
Every CVE that names twenty among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.6 CriticalCritical · CVSS 9+
Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL
- twenty
- Hard-coded credentials
- CVSS 7.1 High
Twenty: Field-level read bypass
- twenty
- Information disclosure
- Broken access control
- CVSS 7.1 High
Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query
- twenty
- Broken access control
- CVSS 5.3 Medium
Twenty Open Redirect via OAuth Propagator Callback
- twenty
- Open redirect
- CVSS 9.1 CriticalCritical · CVSS 9+
Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution
- twenty
- SQL injection
- CVSS 7.6 High
Twenty: Cross-workspace IDOR in AgentTurnResolver
- twenty
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Twenty: SQL Injection via the timeZone field
- twenty
- Command injection
- SQL injection
- CVSS 8.7 High
Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)
- twenty
- Cross-site scripting (XSS)
- CVSS 8.3 High
twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization
- twenty
- Server-side request forgery (SSRF)
- CVSS 5.7 Medium
Twenty: Stored XSS via BlockNote FileBlock
- twenty
- Cross-site scripting (XSS)
- CVSS 5.0 Medium
Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client
- twenty
- Server-side request forgery (SSRF)