T
Twenty
Security Risk Profile
51
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 8 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from March 25, 2024 to present
8
Total CVEs
6
Critical+High
0
Exploited
6
Unpatched
Threat Assessment
Avg CVSS
7.6
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
6
Critical/High
Risk Level
51/100
medium
🆕 1Fresh (<7d)📈 1 in Last 30 Days
Severity Distribution
Critical
2High
4Medium
2Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
3Age Distribution
Common Weaknesses (CWE)
1
XSS
2
2
SSRF
2
3
Infoleak
1
4
OS Command Injection
1
5
SQL Injection
1
Most Affected Products
1. Twenty Twenty9
2. Twenty Twenty CRM3
3. npm/twenty1
4. Twenty CRM platform1
Recent Vulnerabilities
See more →CVE-2026-85055
CVSS 7.1high
Twenty: Field-level read bypass
Sep 22, 2026🔧 No Patch
CVE-2026-55583
CVSS 7.6high
Twenty: Cross-workspace IDOR in AgentTurnResolver
Jun 24, 2026🔧 No Patch
CVE-2026-46624
CVSS 9.9critical
Twenty: SQL Injection via the timeZone field
May 26, 2026🔧 No Patch
CVE-2026-44729
CVSS 8.7high
Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)
May 26, 2026🔧 No Patch
CVE-2026-27023
CVSS 5.0medium
Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client
Mar 5, 2026🔧 No Patch
CVE-2026-26720
CVSS 9.8EPSS 0%critical
Mar 2, 2026🔧 No Patch
CVE-2024-28435
CVSS 5.4EPSS 0%medium
Mar 25, 2024🔧 No Patch
CVE-2024-28434
CVSS 7.6EPSS 0%high
Mar 25, 2024🔧 No Patch
Monitor Twenty in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.