https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 18:16:38 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44729 <p><strong>Affected:</strong> twentyhq twenty</p> <p>Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript, which will be rendered by the victim&#39;s browser in the context of the Twenty CRM domain when accessed — enabling session hijacking, account takeover, and data theft.</p> <p><strong>Affected:</strong> twentyhq twenty</p> <p>Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript, which will be rendered by the victim&#39;s browser in the context of the Twenty CRM domain when accessed — enabling session hijacking, account takeover, and data theft.</p> https://cve.radiocsirt.org/vuln/cve-2026-44729