CVE-2026-63506 | High | 8.8 | 2026-09-16 | Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID an… |
CVE-2026-63123 | Medium | 6.5 | 2026-08-19 | Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin call… |
CVE-2026-59992 | Medium | 5.4 | 2026-08-19 | Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary… |
CVE-2026-55661 | | | 2026-07-01 | Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image rendere… |
CVE-2026-55660 | | | 2026-07-01 | Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-… |
CVE-2026-54074 | High | 7.8 | 2026-07-01 | Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migrat… |
CVE-2026-34604 | High | 7.1 | 2026-04-01 | Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in FilesystemBridge. That bloc… |
CVE-2026-34603 | High | 7.1 | 2026-04-01 | Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but th… |
CVE-2026-33949 | High | 8.1 | 2026-04-01 | Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write… |
CVE-2026-29066 | Medium | 6.2 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's bu… |
CVE-2026-28793 | High | 8.4 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal… |
CVE-2026-28792 | Critical | 9.6 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin… |
CVE-2026-28791 | High | 7.4 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS development server's media upload handler. T… |
CVE-2026-24125 | Medium | 6.3 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths (r… |
CVE-2025-68278 | High | 8.8 | 2025-12-18 | Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers tha… |
CVE-2024-45391 | High | 7.5 | 2024-09-03 | Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search to… |
CVE-2023-25164 | High | 8.6 | 2023-02-08 | Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store… |