T
Vendor security profile
twentyhq
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs5
Critical2
CISA KEV0
Public exploit3
Patch rate%0
Avg. CVSS7.6
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
2
2
1
CVE KEV
CVE severity distribution
5toplam CVE
Critical2 (40%)
High2 (40%)
Medium1 (20%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%60
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
5Unknown
Latest vulnerabilities
9.6
CVE-2026-105763
Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL
T
Patch status unknownEPSS %0
7.1
CVE-2026-85055
Twenty: Field-level read bypass
T
Patch status unknownEPSS %0
7.1
CVE-2026-92771
Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query
T
Patch status unknownEPSS %0
5.3
CVE-2026-82274
Twenty Open Redirect via OAuth Propagator Callback
T
Patch status unknownEPSS %0
9.1
CVE-2026-73069
Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution
T
Patch status unknownEPSS %1