Twenty: SQL Injection via the timeZone field

Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution

Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)

twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization

Twenty: Cross-workspace IDOR in AgentTurnResolver

Twenty: Field-level read bypass

Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query

Twenty: Stored XSS via BlockNote FileBlock

Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client

Twenty Open Redirect via OAuth Propagator Callback