TW
Product
twenty
12
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 3High 4Medium 5Low 0
Watch
Add twenty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44729 | 8.7 | May 26 | Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers) Affected: <= 1.18.0 |
| CVE-2026-33975 | 8.3 | May 5 | twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization Affected: <= 1.18.0 |
| CVE-2026-55583 | 7.6 | Jun 24 | Twenty: Cross-workspace IDOR in AgentTurnResolver Affected: < 2.9.0 |
| CVE-2026-85055 | 7.1 | Sep 22 | Twenty: Field-level read bypass Affected: < 2.22.0 |
Showing 4