Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions

tinacms vulnerable to arbitrary code execution

@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions

Tina: Code injection via unescaped Git branch name in generated client source

@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files

@tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

Tina search token leak via lock file in TinaCMS

Path Traversal in Media Upload Handle in Tina