Vendors / twentyhq Records 14 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 6
Exploited now twentyhq records in CISA KEV No twentyhq vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00933 · Published 2026-03-02 · No fix listed CWE-94
Priority HIGH 76
Twenty is an open source CRM.
CVSS 3.1 CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00483 · Published 2026-05-26 · No fix listed CWE-78
Priority HIGH 74
Twenty is an open-source CRM (customer relationship management) platform.
CVSS 3.1 CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.00655 · Published 2026-08-11 · Fixed in 2.15.0 CWE-89
Priority HIGH 73
Twenty is an open source CRM.
CVSS 3.1 HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00258 · Published 2026-05-26 · No fix listed CWE-79
Priority HIGH 69
Twenty is an open source CRM built with NestJS (Node.js).
CVSS 4.0 HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.0024 · Published 2026-05-05 · No fix listed CWE-918
Priority HIGH 66
Twenty is an open-source CRM (customer relationship management) platform.
CVSS 3.1 HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.00227 · Published 2026-06-24 · Fixed in 2.9.0 CWE-639
Priority HIGH 66
The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0.
CVSS 3.1 HIGH 7.6· Network · No auth · User interaction · EPSS 0.00674 · Published 2024-03-25 · No fix listed CWE-79
Priority MEDIUM 64
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks.
CVSS 4.0 HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00436 · Published 2026-09-16 · Fixed in 2.35.0 CWE-863
Priority MEDIUM 59
Twenty is an open source CRM.
CVSS 3.1 MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.00309 · Published 2026-04-21 · Fixed in 1.20.6 CWE-79
Priority MEDIUM 58
The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.
CVSS 3.1 MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00411 · Published 2024-03-25 · No fix listed CWE-918
Priority MEDIUM 57
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL.
CVSS 4.0 MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00387 · Published 2026-08-28 · No fix listed CWE-601
Priority MEDIUM 43
Twenty is an open-source CRM (customer relationship management) platform.
CVSS 3.1 CRITICAL 9.6· Network · Low privileges · No interaction · EPSS 0.00277 · Published 2026-10-05 · Fixed in 2.7.0 CWE-522
Priority LOW 32
Twenty is an open-source CRM (customer relationship management) platform.
CVSS 4.0 HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00427 · Published 2026-09-22 · Fixed in 2.22.0 CWE-200
Priority LOW 22
Twenty is an open source CRM.
CVSS 3.1 MEDIUM 5.0· Network · Low privileges · No interaction · EPSS 0.00231 · Published 2026-03-05 · Fixed in 1.18 CWE-918
Open these records in search → All records by CVSS severity
4 6 4 0 0
THREATIST.IORead the docs