TI
Vendor
tinacms
30
CVEs
0
On KEV
6
New 30D
Products
TI9.3
tinacms
tinacms
15 CVEs0 on KEV3 new
CL9.6
cli
@tinacms
4 CVEs0 on KEV1 new
AP9.3
app
@tinacms
1 CVEs0 on KEV1 new
WE7.6
web-components
@tinacms
1 CVEs0 on KEV1 new
NE8.8
next-tinacms-azure
tinacms
2 CVEs0 on KEV0 new
AU8.8
auth
@tinacms
1 CVEs0 on KEV0 new
GR6.3
graphql
@tinacms
1 CVEs0 on KEV0 new
NE5.4
next-tinacms-cloudinary
tinacms
1 CVEs0 on KEV0 new
NE5.4
next-tinacms-dos
tinacms
1 CVEs0 on KEV0 new
NE5.4
next-tinacms-s3
tinacms
1 CVEs0 on KEV0 new
TI7.6
@tinacms/app
tinacms
1 CVEs0 on KEV0 new
TI4.8
@tinacms/mdx
tinacms
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-108261 | TI tinacms tinacms | 9.3 | Oct 9 | TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment |
| CVE-2026-108260 | TI tinacms tinacms | 7.6 | Oct 9 | @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS |
| CVE-2026-108259 | TI tinacms tinacms | 8.2 | Oct 9 | Tina: Code injection via unescaped Git branch name in generated client source |
| CVE-2026-63506 | TI tinacms tinacms | 8.8 | Sep 16 | Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site |
| CVE-2026-63123 | TI tinacms tinacms | 6.5 | Aug 19 | Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root |
| CVE-2026-59992 | NE next-tinacms-dos tinacms | 5.4 | Aug 19 | Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) |
| CVE-2026-55660 | TI tinacms tinacms | 7.6 | Jul 1 | TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover |
| CVE-2026-54074 | TI tinacms tinacms | 7.8 | Jul 1 | @tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels |
| CVE-2026-55661 | TI tinacms tinacms | 4.8 | Jul 1 | TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes |
| CVE-2026-34603 | TI tinacms tinacms | 8.3 | Apr 1 | @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions |
| CVE-2026-34604 | TI tinacms tinacms | 8.8 | Apr 1 | @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions |
| CVE-2026-33949 | TI tinacms tinacms | 8.1 | Apr 1 | @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files |
| CVE-2026-29066 | CL cli @tinacms | 6.2 | Mar 12 | Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI |
| CVE-2026-28791 | TI tinacms tinacms | 7.4 | Mar 12 | Path Traversal in Media Upload Handle in Tina |
| CVE-2026-28793 | CL cli @tinacms | 8.4 | Mar 12 | Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS |
| CVE-2026-28792 | CL cli @tinacms | 9.6 | Mar 12 | Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS |
| CVE-2026-24125 | GR graphql @tinacms | 6.3 | Mar 12 | Path Traversal in @tinacms/graphql |
| CVE-2025-68278 | TI tinacms tinacms | 8.8 | Dec 18 | tinacms vulnerable to arbitrary code execution |
| CVE-2024-45391 | TI tinacms tinacms | 7.5 | Sep 3 | Tina search token leak via lock file in TinaCMS |