https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-22T02:14:49.645651+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-292224 EUVD-2026-292224 2026-10-22T02:14:49.647475+00:00 EUVD-2026-292224 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35451 fkie_cve-2026-35451 2026-10-22T02:14:49.647508+00:00

Twenty is an open source CRM. Prior to 1.20.6, a Stored Cross-Site Scripting (XSS) vulnerability exists in the BlockNote editor component. Due to a lack of protocol validation in the FileBlock component and insufficient server-side inspection of block content, an attacker can inject a javascript: URI into the url property of a file block. This allows the execution of arbitrary JavaScript when a user clicks on the malicious file attachment. This vulnerability is fixed in 1.20.6.