agentprime: twentyEvery new CVE for twenty.https://agentprime.io/CVE-2026-105763: Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQLhttps://agentprime.io/advisories/CVE-2026-105763/https://agentprime.io/advisories/CVE-2026-105763/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 23:05:56 GMTCVEcriticalCVE-2026-85055: Twenty: Field-level read bypasshttps://agentprime.io/advisories/CVE-2026-85055/https://agentprime.io/advisories/CVE-2026-85055/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 15:20:22 GMTCVECVE-2026-92771: Twenty before 2.35.0 Permission Bypass via groupBy-with-records Queryhttps://agentprime.io/advisories/CVE-2026-92771/https://agentprime.io/advisories/CVE-2026-92771/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 20:32:32 GMTCVECVE-2026-82274: Twenty Open Redirect via OAuth Propagator Callbackhttps://agentprime.io/advisories/CVE-2026-82274/https://agentprime.io/advisories/CVE-2026-82274/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 28 Aug 2026 16:18:56 GMTCVECVE-2026-73069: Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Executionhttps://agentprime.io/advisories/CVE-2026-73069/https://agentprime.io/advisories/CVE-2026-73069/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 15:18:56 GMTCVEcriticalCVE-2026-55583: Twenty: Cross-workspace IDOR in AgentTurnResolverhttps://agentprime.io/advisories/CVE-2026-55583/https://agentprime.io/advisories/CVE-2026-55583/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 19:21:35 GMTCVECVE-2026-46624: Twenty: SQL Injection via the timeZone fieldhttps://agentprime.io/advisories/CVE-2026-46624/https://agentprime.io/advisories/CVE-2026-46624/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 26 May 2026 17:01:16 GMTCVEcriticalCVE-2026-44729: Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)https://agentprime.io/advisories/CVE-2026-44729/https://agentprime.io/advisories/CVE-2026-44729/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 26 May 2026 16:56:06 GMTCVECVE-2026-33975: twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalizationhttps://agentprime.io/advisories/CVE-2026-33975/https://agentprime.io/advisories/CVE-2026-33975/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 05 May 2026 19:19:18 GMTCVECVE-2026-35451: Twenty: Stored XSS via BlockNote FileBlockhttps://agentprime.io/advisories/CVE-2026-35451/https://agentprime.io/advisories/CVE-2026-35451/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 16:22:30 GMTCVECVE-2026-27023: Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP clienthttps://agentprime.io/advisories/CVE-2026-27023/https://agentprime.io/advisories/CVE-2026-27023/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Mar 2026 16:23:31 GMTCVE