Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
28 results
Oct 24, 2026Advanced Twenty Seventeen: Does not perform any capability or nonce check on the action that creates and activates its bundled childCVE-2026-107887 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.
- Product
- Advanced Twenty Seventeen
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Advanced Twenty Seventeen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Twenty is an open-source CRM (customer relationship management) platform.CVE-2026-105763 · Other software · twentyhq · reported by GitHubCritical 9.6
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords, because the field was not hidden and the lookup did not enforce the calling user's identity or account visibility. A normal workspace member could obtain other members' external-service credentials and use them to access mail or calendars and potentially reset third-party accounts. Google and Microsoft OAuth-only workspaces were not affected. This issue is fixed in version 2.7.0.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2026Twenty20 Image Before-After: Stored Cross-Site ScriptingCVE-2026-92767 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Twenty20 Image Before-After
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Twenty20 Image Before-After to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026Twenty is an open-source CRM (customer relationship management) platform.CVE-2026-85055 · Other software · twentyhq · reported by GitHubHigh 7.1
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can reference that denied field in direct filters, relation filters, or persisted view filters. The resulting totalCount and row presence reveal whether guesses match the real column, forming a boolean/count oracle that can reconstruct denied field values for records exposed by the principal's row-level policy. This issue is fixed in version 2.22.0.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permissionCVE-2026-92771 · Other software · twentyhq · reported by VulnCheckHigh 7.1
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query paramCVE-2026-82274 · Other software · twentyhq · reported by VulnCheckMedium 5.3
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Twenty is an open-source CRM (customer relationship management) platform.CVE-2026-73069 · Other software · twentyhq · reported by GitHubCritical 9.1
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, causing buildSqlColumnDefinition in packages/twenty-server/src/engine/twenty-orm/workspace-schema-manager/utils/build-sql-column-definition.util.ts to concatenate unescaped input into GENERATED ALWAYS AS (...) and execute arbitrary PostgreSQL statements as the application database user. This issue is fixed in version 2.15.0.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Twenty is an open-source CRM (customer relationship management) platform.CVE-2026-55583 · Other software · twentyhq · reported by GitHubHigh 7.6
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object reference (IDOR) in the AI agent monitor's AgentTurnResolver, in packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-monitor/reso lvers/agent-turn.resolver.ts. The agentTurns(agentId) query and the evaluateAgentTurn(turnId) mutation looked up rows by agentId or id only; although AgentTurnEntity has a workspaceId column, it was not included in the WHERE clause, and the class-level guards only checked that the caller was authenticated in some workspace rather than that the requested object belonged to it, with the same flaw present in agent-turn-grader.service.ts. As a result, any authenticated user with the AI settings flag, a workspace owner by default, could target any other workspace on the same instance given the victim's agentId or turnId: agentTurns returned the victim's full chat history including message parts such as raw chat text, tool calls, and tool outputs, while evaluateAgentTurn inserted an agentTurnEvaluation row with the victim's workspaceId and fed the victim's turn into the default LLM. The agentId
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Twenty is an open source CRM.CVE-2026-46624 · Other software · twentyhq · reported by GitHubCritical 9.9
Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. The timeZone field within the group_by query parameter is directly interpolated into a raw SQL expression using JavaScript template literals without any parameterization, validation, or escaping. This affects engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Twenty is an open source CRM.CVE-2026-44729 · Other software · twentyhq · reported by GitHubHigh 8.7
Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript, which will be rendered by the victim's browser in the context of the Twenty CRM domain when accessed — enabling session hijacking, account takeover, and data theft.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026Twenty is an open source CRM built with NestJS (Node.js).CVE-2026-33975 · Other software · twentyhq · reported by GitHubHigh 8.3
Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpClientService can be bypassed using IPv4-mapped IPv6 addresses in URL IP literals. Node.js's URL parser normalizes IPv4-mapped IPv6 addresses to compressed hex form (e.g., ::ffff:169.254.169.254 becomes ::ffff:a9fe:a9fe), but the isPrivateIp utility only recognizes the dotted-decimal notation. As a result, the hex form passes the SSRF check unchecked. Additionally, the socket lookup validation event does not fire for IP literal addresses, bypassing the second validation layer. An authenticated user can reach any internal IP, including cloud metadata endpoints, to exfiltrate credentials such as IAM keys.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Twenty is an open source CRM.CVE-2026-35451 · Other software · twentyhq · reported by GitHubMedium 5.7
Twenty is an open source CRM. Prior to 1.20.6, a Stored Cross-Site Scripting (XSS) vulnerability exists in the BlockNote editor component. Due to a lack of protocol validation in the FileBlock component and insufficient server-side inspection of block content, an attacker can inject a javascript: URI into the url property of a file block. This allows the execution of arbitrary JavaScript when a user clicks on the malicious file attachment. This vulnerability is fixed in 1.20.6.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Twenty is an open source CRM.CVE-2026-27023 · Other software · twentyhq · reported by GitHubMedium 5
Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not validate redirect targets. An authenticated user who could control outbound request URLs (e.g., webhook endpoints, image URLs) could bypass private IP blocking by redirecting through an attacker-controlled server. This issue has been patched in version 1.18.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.CVE-2026-26720 · Other software · Twenty · reported by MITRECritical 9.8
An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.
- Product
- Twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddillonkirsch.comgithub.com
Jan 7, 2025jQuery TwentyTwenty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22546 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Obaid Hossain jQuery TwentyTwenty js-twentytwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through <= 1.0.
- Product
- jQuery TwentyTwenty
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update jQuery TwentyTwenty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024TwentyTwenty: Stored Cross-Site ScriptingCVE-2024-11352 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TwentyTwenty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'twentytwenty' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- TwentyTwenty
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update TwentyTwenty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 20, 20247Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-42335 · Other software · 7Twenty · reported by cna@cyber.gov.ilMedium 5.4
7Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- 7Twenty Bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.CVE-2024-28435 · Other software · twentyhq · reported by MITREMedium 5.4
The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0.CVE-2024-28434 · Other software · crm · reported by MITREHigh 7.6
The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0. A crafted svg file can trigger the execution of the javascript code.
- Product
- platform_twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023Options for Twenty Seventeen: Stored Cross-Site ScriptingCVE-2023-5162 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Options for Twenty Seventeen plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social-links' shortcode in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Options for Twenty Seventeen
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Options for Twenty Seventeen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2023 7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').CVE-2023-37221 · Other software · 7Twenty · reported by cna@cyber.gov.ilHigh 8.8
7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
- Product
- BOT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Twenty20 Image Before-After: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4580 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Twenty20 Image Before-After WordPress plugin through 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Twenty20 Image Before-After
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update Twenty20 Image Before-After to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 15, 2022x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot.CVE-2022-23604 · Other software · Twentysix26 · reported by GitHubHigh 8.8
x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands. The issue has been patched in version 1.10.0. One may unload the Defender cog as a workaround.
- Product
- x26-Cogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2020A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, allCVE-2020-10758 · Other software · Redhat · reported by Red HatHigh 7.5
A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.
- Product
- Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Oct 23, 2019The Easy Digital Downloads (EDD) Twenty-Twelve theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2CVE-2015-9536 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Twenty-Twelve theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Aug 13, 2019An issue was discovered in 20|20 Storage 2.11.0.CVE-2019-12479 · Other software · Twentytwenty.storage Project · reported by MITRECritical 9.1
An issue was discovered in 20|20 Storage 2.11.0. A Path Traversal vulnerability in the TwentyTwenty.Storage library in the LocalStorageProvider allows creating and reading files outside of the specified basepath. If the application using this library does not sanitize user-supplied filenames, then this issue may be exploited to read or write arbitrary files. This affects LocalStorageProvider.cs.
- Product
- Twentytwenty.storage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity401.comsecurity401.com
Aug 11, 2008Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to executCVE-2008-3592 · Other software · 21degrees · reported by MITREHigh 8.5
Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to a directory specified in the destination parameter, then accessing the uploaded file via a direct request, as demonstrated using workspace/masters/.
- Product
- Symphony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoverture21.comsecunia.com
Aug 11, 2008SQL injection vulnerability in lib/class.admin.php in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary SQL commands viCVE-2008-3591 · Other software · 21degrees · reported by MITREHigh 7.5
SQL injection vulnerability in lib/class.admin.php in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary SQL commands via the sym_auth cookie in a /publish/filemanager/ request to index.php.
- Product
- Symphony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoverture21.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.