twenty kayıtları

twenty üreticisine ait 6 yayımlanmış kayıt.

Araştırmacı profili

Yıllara göre kayıt

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

Saldırı profili

6 kayıt

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
39İzleyin	CVE-2026-26720Kavram kanıtı	An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.twenty · twenty · CWE-94 pre-auth RCE	Kritik9,8	—	%1,2	2 Mar 2026
39İzleyin	CVE-2026-46624İstismar yok	Twenty: SQL Injection via the timeZone fieldtwenty · twenty · CWE-78 RCE SQL enjeksiyonu Komut enjeksiyonu	Kritik9,9	—	%0,7	26 May 2026
34İzleyin	CVE-2026-44729İstismar yok	Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)twenty · twenty · CWE-79 XSS	Yüksek8,7	—	%0,4	26 May 2026
30İzleyin	CVE-2024-28434İstismar yok	The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0.twenty · twenty · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,6	—	%0,7	25 Mar 2024
21İzleyin	CVE-2024-28435İstismar yok	The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.twenty · twenty · CWE-918 Kimlik doğrulamasız SSRF	Orta5,4	—	%0,4	25 Mar 2024
20İzleyin	CVE-2026-27023İstismar yok	Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP clienttwenty · twenty · CWE-918 SSRF	Orta5,0	—	%0,3	5 Mar 2026

CVE-2026-26720
39İzleyin
An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.
KritikCVSS 9,8Kavram kanıtıEPSS %1
- pre-auth RCE
twenty · twenty2 Mar 2026
CVE-2026-46624
39İzleyin
Twenty: SQL Injection via the timeZone field
KritikCVSS 9,9İstismar yokEPSS %1
twenty · twenty26 May 2026
CVE-2026-44729
34İzleyin
Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)
YüksekCVSS 8,7İstismar yokEPSS %0
- XSS
twenty · twenty26 May 2026
CVE-2024-28434
30İzleyin
The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0.
YüksekCVSS 7,6İstismar yokEPSS %1
- Kimlik doğrulamasız
- XSS
twenty · twenty25 Mar 2024
CVE-2024-28435
21İzleyin
The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.
OrtaCVSS 5,4İstismar yokEPSS %0
- Kimlik doğrulamasız
- SSRF
twenty · twenty25 Mar 2024
CVE-2026-27023
20İzleyin
Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client
OrtaCVSS 5,0İstismar yokEPSS %0
- SSRF
twenty · twenty5 Mar 2026