TI
Product
tinacms
16
CVEs
0
On KEV
9.3
Max CVSS
3
New 30D
Severity mix
Critical 1High 12Medium 3Low 0
Watch
Add tinacms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-63123 | 6.5 | Aug 19 | Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root Affected: < 2.5.2 |
| CVE-2026-59992 | 5.4 | Aug 19 | Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) Affected: < 23.0.4 |
| CVE-2026-55661 | 4.8 | Jul 1 | TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes Affected: < 3.9.3 |
Showing 3