Tinacms @tinacms/app vulnerabilities

• tinacms @tinacms/app, tinacms +1 more TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover CVE-2026-55660 Fix available 7.6 HighJune 19, 2026