Skip to content
@tinacms vulnerabilities
Newest
-
@tinacms app, tinacms +1 more
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
CVE-2026-108261
Fix available
9.3 Critical
-
@tinacms web-components, tinacms +1 more
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
CVE-2026-108260
Fix available
7.6 High
-
@tinacms cli, tinacms +1 more
Tina: Code injection via unescaped Git branch name in generated client source
CVE-2026-108259
Fix available
8.2 High
-
@tinacms auth, tinacms next-tinacms-azure, tinacms +2 more
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
CVE-2026-63506
Fix available
8.8 High
-
@tinacms graphql
Privilege Escalation via Dropped Field-Level @authentication
CVE-2026-19869
7.6 High
-
@tinacms graphql
Subscription Authentication Bypass via Unverified connectionParams.jwt
CVE-2026-5423
8.2 High
-
@tinacms cli, ssw tinacms\/cli +1 more
Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI
CVE-2026-29066
Fix available
6.2 Medium
-
@tinacms cli, ssw tinacms\/cli +1 more
Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS
CVE-2026-28793
Fix available
8.4 High
-
@tinacms cli, ssw tinacms\/cli +1 more
Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
CVE-2026-28792
Fix available
9.7 Critical
-
@tinacms graphql, ssw tinacms\/graphql +1 more
Path Traversal in @tinacms/graphql
CVE-2026-24125
Fix available
6.3 Medium
-
@tinacms graphql, hasura graphql engine +1 more
Hasura GraphQL 1.3.3 - Remote Code Execution
CVE-2021-47748
9.3 Critical
-
@tinacms graphql
graphql Uncontrolled Resource Consumption vulnerability
CVE-2023-26144
Public exploitFix available
5.3 Medium