CVE-2026-108261

Published 9 October 2026 · tracked since 10 October 2026

Description

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while pac

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-103889 CRITICAL 9.8
• CVE-2026-104021 HIGH 7.2
• CVE-2026-104735 MEDIUM 6.4
• CVE-2026-102401 MEDIUM 6.4
• CVE-2026-96743 MEDIUM 6.4
• CVE-2026-94589 CRITICAL 9.8
• CVE-2026-107645 CRITICAL 9.1
• CVE-2026-104732 CRITICAL 9.8
• CVE-2026-104797 HIGH 8.1
• CVE-2026-104898 MEDIUM 6.8

→ Open the live CVE board · all tools