twentyhq twenty

• CVE-2026-105763 Critical 9.6 Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL 0.3%
• CVE-2026-85055 High 7.1 Twenty: Field-level read bypass 0.4%
• CVE-2026-92771 Medium 6.5 Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query 0.4%
• CVE-2026-82274 Medium 4.7 Twenty Open Redirect via OAuth Propagator Callback 0.4%
• CVE-2026-73069 Critical 9.1 Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution 0.7%
• CVE-2026-55583 High 7.6 Twenty: Cross-workspace IDOR in AgentTurnResolver 0.2%
• CVE-2026-46624 Critical 9.9 Twenty: SQL Injection via the timeZone field 0.5%
• CVE-2026-44729 High 8.7 Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers) 0.3%
• CVE-2026-33975 High 8.3 twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization 0.2%
• CVE-2026-35451 Medium 5.7 Twenty: Stored XSS via BlockNote FileBlock 0.3%
• CVE-2026-27023 Medium 5.0 Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client 0.2%