twentyhq

Records14All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

twentyhq records in CISA KEV

No twentyhq vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

6 records in Twenty · all components

TI-2026-21368 CVE-2026-26720 · GHSA-227p-wwrh-m869

HIGH 82

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00933 Published 2026-03-02 No fix listed CWE-94

TI-2026-34280 CVE-2026-46624

HIGH 76

Twenty is an open source CRM.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00483 Published 2026-05-26 No fix listed CWE-78

TI-2026-32616 CVE-2026-44729

HIGH 73

Twenty is an open source CRM.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00258 Published 2026-05-26 No fix listed CWE-79

TI-2024-18876 CVE-2024-28434 · GHSA-x7hp-f23m-66mj

HIGH 66

The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.00674 Published 2024-03-25 No fix listed CWE-79

TI-2024-18877 CVE-2024-28435 · GHSA-6cqh-4xr5-c65x

MEDIUM 58

The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00411 Published 2024-03-25 No fix listed CWE-918

TI-2026-21496 CVE-2026-27023

LOW 22

Twenty is an open source CRM.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00231 Published 2026-03-05 Fixed in 1.18 CWE-918