Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,739All CVEsplus 19,141 rejected
- 660Last 24 hours3,039 in the last 7 days
- 17,185Last 30 days1,610 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 9 | 3 | 0 | 0 | 13 | 16 |
| 2025 | 0 | 1 | 0 | 0 | 0 | 1 | 3 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 2 |
| 2023 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-108261 | TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmenttinacms · tinacms | Critical9.3 |
| CVE-2026-108260 | @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSStinacms · tinacms | High7.6 |
| CVE-2026-108259 | Tina: Code injection via unescaped Git branch name in generated client sourcetinacms · tinacms | High8.2 |
| CVE-2026-63506 | Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted sitetinacms · tinacms | High8.8 |
| CVE-2026-63123 | Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media roottinacms · tinacms | Medium6.5 |
| CVE-2026-59992 | Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)tinacms · tinacms | Medium5.4 |
| CVE-2026-55660 | TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeovertinacms · tinacms | High7.6 |
| CVE-2026-54074 | @tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labelstinacms · tinacms | High7.8 |
| CVE-2026-55661 | TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemestinacms · tinacms | Medium4.8 |
| CVE-2026-34603 | @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctionstinacms · tinacms | High7.1 |
| CVE-2026-34604 | @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctionstinacms · tinacms | High7.1 |
| CVE-2026-33949 | @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary filestinacms · tinacms | High8.1 |
| CVE-2026-28791 | Path Traversal in Media Upload Handle in Tinatinacms · tinacms | High7.4 |
| CVE-2025-68278 | tinacms vulnerable to arbitrary code executiontinacms · tinacms | High7.3 |
| CVE-2024-45391 | Tina search token leak via lock file in TinaCMStinacms · tinacms | High7.5 |
| CVE-2023-25164 | Sensitive Information leak via Script File in TinaCMStinacms · tinacms | High8.6 |