TW
Vendor
Twenty
6
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-46624 | TW Twenty Twenty | 9.9 | May 26 | Twenty: SQL Injection via the timeZone field |
| CVE-2026-44729 | TW Twenty Twenty | 8.7 | May 26 | Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers) |
| CVE-2026-27023 | TW Twenty Twenty | 5.0 | Mar 5 | Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client |
| CVE-2026-26720 | TW Twenty Twenty | 9.8 | Mar 2 | An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module |
| CVE-2024-28434 | TW Twenty Twenty | 7.6 | Mar 25 | The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0 |
| CVE-2024-28435 | TW Twenty Twenty | 5.4 | Mar 25 | The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload |