{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T21:06:40.754Z", "lastRun": "2026-10-23T21:01:12.729Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "npm" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-77363", "url": "https://cveboard.org/i/cve-2026-77363", "urlPt": "https://cveboard.org/pt/i/cve-2026-77363", "json": "https://cveboard.org/i/cve-2026-77363.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback", "summary": "The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: \"none\" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-local with scopes [\"*\"] — full vault read/write — via DNS rebinding / a forged Origin.", "titlePt": "obsidian-tc: transporte HTTP falta proteção Origin/DNS-rebinding, permitindo acesso drive-by ao cofre no loopback", "summaryPt": "O transporte HTTP Streamable foi construído sem enableDnsRebindingProtection/allowedHosts/allowedOrigins e não realizou validação de cabeçalho Origin. Com o modo de autenticação documentado auth.mode: \"none\" padrão de loopback, uma página web drive-by poderia POST http://127.0.0.1/mcp e receber chamada http-local com escopos [\"*\"] — leitura/gravação completa do cofre — via DNS rebinding / um Origin forjado.", "affected": [], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-346", "name": "Origin Validation Error" }, { "id": "CWE-1385", "name": "Missing Origin Validation in WebSockets" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-13T16:02:58.070Z" }, "fix": "listed", "tags": [ "the-40-thieves", "npm" ], "cves": [ "CVE-2026-77363" ], "ghsa": "GHSA-pqh8-4pj7-32xx", "cvss": { "score": 9.6, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00157, "percentile": 0.0452, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "npm", "name": "obsidian-tc", "vulnerable": "< 1.3.1", "fixed": "1.3.1", "advisory": "GHSA-pqh8-4pj7-32xx" } ], "vendor": "The-40-Thieves", "product": "obsidian-tc", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-pqh8-4pj7-32xx" } ], "cvePending": true, "publishedAt": "2026-10-23T18:29:02.000Z", "updatedAt": "2026-10-23T18:29:02.000Z" }, { "id": "cve-2026-77366", "url": "https://cveboard.org/i/cve-2026-77366", "urlPt": "https://cveboard.org/pt/i/cve-2026-77366", "json": "https://cveboard.org/i/cve-2026-77366.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "obsidian-tc tokens can access arbitrary configured vaults", "summary": "Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault (ctx.vaultId); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault, defeating multi-tenant isolation across ~90 tool sites.", "titlePt": "tokens do obsidian-tc podem acessar vaults configurados arbitrários", "summaryPt": "A chamada de ferramenta não verificou a entrada.vault fornecida pelo chamador contra o vault vinculado do chamador (ctx.vaultId); o ACL da pasta era uma única instância global e o JWT não carregava nenhuma reivindicação de vault. Como resultado, qualquer token válido poderia ler, escrever ou excluir qualquer vault configurado passando input.vault, derrotando o isolamento multi-inquilino em ~90 sites de ferramentas.", "affected": [], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, { "id": "CWE-863", "name": "Incorrect Authorization" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-13T15:14:24.356Z" }, "fix": "listed", "tags": [ "the-40-thieves", "npm" ], "cves": [ "CVE-2026-77366" ], "ghsa": "GHSA-84c9-qqpq-2pq5", "cvss": { "score": 9.9, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00308, "percentile": 0.22442, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "npm", "name": "obsidian-tc", "vulnerable": "< 1.3.1", "fixed": "1.3.1", "advisory": "GHSA-84c9-qqpq-2pq5" } ], "vendor": "The-40-Thieves", "product": "obsidian-tc", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-84c9-qqpq-2pq5" } ], "cvePending": true, "publishedAt": "2026-10-23T17:29:17.000Z", "updatedAt": "2026-10-23T17:29:17.000Z" }, { "id": "ghsa-673q-mjm6-r5xr", "url": "https://cveboard.org/i/ghsa-673q-mjm6-r5xr", "urlPt": "https://cveboard.org/pt/i/ghsa-673q-mjm6-r5xr", "json": "https://cveboard.org/i/ghsa-673q-mjm6-r5xr.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays", "summary": "A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.", "titlePt": "Next.js: Execução remota de código não autenticada nas funções `use cache` que retornam arrays tipados", "summaryPt": "Uma vulnerabilidade em aplicações que utilizam o App router com o Cache Component pode levar à execução remota de código. A aplicação precisa ter uma função use cache que retorna múltiplos arrays tipados.", "affected": [], "omitted": 0, "references": [], "cwes": [], "ssvc": null, "fix": "listed", "tags": [ "npm" ], "cves": [], "ghsa": "GHSA-673q-mjm6-r5xr", "cvss": { "score": 9.5, "version": "4.0", "by": "GitHub" }, "epss": null, "packages": [ { "ecosystem": "npm", "name": "next", "vulnerable": ">= 16.0.0, <= 16.4.0", "fixed": "16.4.1", "advisory": "GHSA-673q-mjm6-r5xr" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-673q-mjm6-r5xr" } ], "cvePending": false, "publishedAt": "2026-10-22T16:42:31.000Z", "updatedAt": "2026-10-22T16:42:31.000Z" }, { "id": "ghsa-cg2g-xh64-v4q7", "url": "https://cveboard.org/i/ghsa-cg2g-xh64-v4q7", "urlPt": "https://cveboard.org/pt/i/ghsa-cg2g-xh64-v4q7", "json": "https://cveboard.org/i/ghsa-cg2g-xh64-v4q7.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "summary": "When DOMPurify is configured with SAFE_FOR_TEMPLATES: true together with a DOM-returning mode (RETURN_DOM: true, RETURN_DOM_FRAGMENT: true, or IN_PLACE: true), template expressions such as {{...}}, ${...}, and <%...%> survive sanitization inside the text content of an attached shadow root. The post-walk safety net _scrubTemplateExpressions (src/purify.", "titlePt": "Contornar SAFE_FOR_TEMPLATES do DOMPurify: expressões de template divididas sobrevivem no conteúdo da shadow root anexada nos modos de saída DOM", "summaryPt": "Quando o DOMPurify é configurado com SAFE_FOR_TEMPLATES: true junto com um modo de retorno DOM (RETURN_DOM: true, RETURN_DOM_FRAGMENT: true, ou IN_PLACE: true), expressões de template como {{...}}, ${...} e <%...%> sobrevivem à sanitização dentro do conteúdo de texto de uma shadow root anexada. A rede de segurança pós-caminhada _scrubTemplateExpressions (src/purify.", "affected": [], "omitted": 0, "references": [], "cwes": [], "ssvc": null, "fix": "listed", "tags": [ "npm" ], "cves": [], "ghsa": "GHSA-cg2g-xh64-v4q7", "cvss": { "score": 9.2, "version": "4.0", "by": "GitHub" }, "epss": null, "packages": [ { "ecosystem": "npm", "name": "dompurify", "vulnerable": ">= 3.4.4, <= 3.4.16", "fixed": "3.4.17", "advisory": "GHSA-cg2g-xh64-v4q7" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7" } ], "cvePending": false, "publishedAt": "2026-10-22T16:25:31.000Z", "updatedAt": "2026-10-22T16:25:31.000Z" }, { "id": "cve-2026-114139", "url": "https://cveboard.org/i/cve-2026-114139", "urlPt": "https://cveboard.org/pt/i/cve-2026-114139", "json": "https://cveboard.org/i/cve-2026-114139.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Sentry-Javascript: Middleware Bypass when using Tunnel route", "summary": "The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server (for example /monitoring), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them.", "titlePt": "Sentry-Javascript: Contorno de Middleware ao usar a rota Tunnel", "summaryPt": "A opção tunnelRoute faz com que o SDK envie eventos do navegador para um caminho no seu próprio servidor Next.js (por exemplo /monitoring), onde um redirecionamento os encaminha para o Sentry para evitar que bloqueadores de anúncios os bloqueiem. Para evitar que esses pedidos de envelope sejam rejeitados pelo seu middleware, o SDK ignora o middleware para eles.", "affected": [], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure" } ], "ssvc": null, "fix": "listed", "tags": [ "getsentry", "npm" ], "cves": [ "CVE-2026-114139" ], "ghsa": "GHSA-mchm-gjx6-7h55", "cvss": { "score": 9.1, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00407, "percentile": 0.33843, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "npm", "name": "@sentry/nextjs", "vulnerable": ">= 9.36.0, < 9.47.2", "fixed": "9.47.2", "advisory": "GHSA-mchm-gjx6-7h55" }, { "ecosystem": "npm", "name": "@sentry/nextjs", "vulnerable": ">= 10.0.0-alpha.0, < 10.75.2", "fixed": "10.75.2", "advisory": "GHSA-mchm-gjx6-7h55" }, { "ecosystem": "npm", "name": "@sentry/nextjs", "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-rc.1", "fixed": "11.0.0-rc.1", "advisory": "GHSA-mchm-gjx6-7h55" } ], "vendor": "getsentry", "product": "sentry-javascript", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-mchm-gjx6-7h55" } ], "cvePending": true, "publishedAt": "2026-10-22T15:55:07.000Z", "updatedAt": "2026-10-22T15:55:07.000Z" }, { "id": "ghsa-2464-fhr4-w9xw", "url": "https://cveboard.org/i/ghsa-2464-fhr4-w9xw", "urlPt": "https://cveboard.org/pt/i/ghsa-2464-fhr4-w9xw", "json": "https://cveboard.org/i/ghsa-2464-fhr4-w9xw.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used", "summary": "A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.", "titlePt": "Next.js: Execução remota de código não autenticada na API de otimização de imagens quando arquivos SVG são usados.", "summaryPt": "Uma vulnerabilidade relacionada à memória foi descoberta em uma biblioteca upstream usada para otimização de imagens, que pode levar à possível execução remota de código (RCE) quando o Next.js é executado em Linux baseado em glibc.", "affected": [], "omitted": 0, "references": [], "cwes": [], "ssvc": null, "fix": "listed", "tags": [ "npm" ], "cves": [], "ghsa": "GHSA-2464-fhr4-w9xw", "cvss": { "score": 9.5, "version": "4.0", "by": "GitHub" }, "epss": null, "packages": [ { "ecosystem": "npm", "name": "next", "vulnerable": ">= 10.0.0, <= 15.5.27", "fixed": "15.5.28", "advisory": "GHSA-2464-fhr4-w9xw" }, { "ecosystem": "npm", "name": "next", "vulnerable": ">= 16.0.0, <= 16.4.0", "fixed": "16.4.1", "advisory": "GHSA-2464-fhr4-w9xw" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-2464-fhr4-w9xw" } ], "cvePending": false, "publishedAt": "2026-10-22T15:52:53.000Z", "updatedAt": "2026-10-22T15:52:53.000Z" }, { "id": "cve-2026-114125", "url": "https://cveboard.org/i/cve-2026-114125", "urlPt": "https://cveboard.org/pt/i/cve-2026-114125", "json": "https://cveboard.org/i/cve-2026-114125.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites", "summary": "A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.", "titlePt": "Storybook: Falta de validação de origem no preview do Storybook permite a injeção de código de sites maliciosos", "summaryPt": "Um site malicioso pode ser capaz de causar alterações não autorizadas em arquivos de um projeto de um desenvolvedor enquanto um servidor de desenvolvimento Storybook afetado está em execução. Sob condições adicionais, um arquivo alterado pode ser executado por um tempo de execução local com os privilégios do desenvolvedor. Não temos conhecimento de exploração na natureza.", "affected": [], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" }, { "id": "CWE-346", "name": "Origin Validation Error" }, { "id": "CWE-1021", "name": "Improper Restriction of Rendered UI Layers or Frames" } ], "ssvc": null, "fix": "listed", "tags": [ "storybookjs", "npm" ], "cves": [ "CVE-2026-114125" ], "ghsa": "GHSA-f2ph-cmg5-wxc8", "cvss": { "score": 9.4, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00375, "percentile": 0.30272, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "npm", "name": "storybook", "vulnerable": ">= 8.0.0, < 8.6.19", "fixed": "8.6.19", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "storybook", "vulnerable": ">= 9.0.0, < 9.1.21", "fixed": "9.1.21", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "storybook", "vulnerable": ">= 10.0.0, < 10.6.2", "fixed": "10.6.2", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "storybook", "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6", "fixed": "11.0.0-alpha.6", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/core", "vulnerable": ">= 8.0.0, < 8.6.19", "fixed": "8.6.19", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/core-server", "vulnerable": ">= 8.0.0, < 8.6.19", "fixed": "8.6.19", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/experimental-addon-test", "vulnerable": ">= 8.0.0, < 8.6.19", "fixed": "8.6.19", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/addon-vitest", "vulnerable": ">= 9.0.0, < 9.1.21", "fixed": "9.1.21", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/addon-vitest", "vulnerable": ">= 10.0.0, < 10.6.2", "fixed": "10.6.2", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/addon-vitest", "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6", "fixed": "11.0.0-alpha.6", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/addon-mcp", "vulnerable": ">= 10.6.0, < 10.6.2", "fixed": "10.6.2", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/addon-mcp", "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6", "fixed": "11.0.0-alpha.6", "advisory": "GHSA-f2ph-cmg5-wxc8" } ], "vendor": "storybookjs", "product": "storybook", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8" } ], "cvePending": true, "publishedAt": "2026-10-21T17:23:29.000Z", "updatedAt": "2026-10-21T17:23:29.000Z" }, { "id": "cve-2026-102989", "url": "https://cveboard.org/i/cve-2026-102989", "urlPt": "https://cveboard.org/pt/i/cve-2026-102989", "json": "https://cveboard.org/i/cve-2026-102989.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses", "summary": "An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority.", "titlePt": "TanStack Router: XSS refletido não autenticado nas respostas de função de servidor do TanStack Start", "summaryPt": "Um atacante não autenticado pode criar uma URL para uma função de servidor em um aplicativo TanStack Start afetado. Se alguém abrir o link, o aplicativo pode retornar HTML controlado pelo atacante de sua própria origem e executar o JavaScript do atacante. O script pode acessar dados de mesma origem disponíveis para aquele visitante e fazer solicitações com sua autoridade.", "affected": [ { "vendor": "TanStack", "product": "router", "defaultStatus": "unknown", "versions": [ { "version": "< release-2026-09-30-1747", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "@tanstack", "product": "react-start", "defaultStatus": "unknown", "versions": [ { "version": ">= 1.143.12, < 1.168.60", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "@tanstack", "product": "solid-start", "defaultStatus": "unknown", "versions": [ { "version": ">= 1.143.12, < 1.168.57", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "@tanstack", "product": "start-server-core", "defaultStatus": "unknown", "versions": [ { "version": ">= 1.143.12, < 1.169.39", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "@tanstack", "product": "vue-start", "defaultStatus": "unknown", "versions": [ { "version": ">= 1.143.12, < 1.168.56", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-14T15:19:40.392Z" }, "fix": "listed", "tags": [ "tanstack", "npm" ], "cves": [ "CVE-2026-102989" ], "ghsa": "GHSA-qx66-fv34-fjm8", "cvss": { "score": 9.3, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00516, "percentile": 0.43087, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "npm", "name": "@tanstack/start-server-core", "vulnerable": ">= 1.143.12, < 1.169.39", "fixed": "1.169.39", "advisory": "GHSA-qx66-fv34-fjm8" }, { "ecosystem": "npm", "name": "@tanstack/react-start", "vulnerable": ">= 1.143.12, < 1.168.60", "fixed": "1.168.60", "advisory": "GHSA-qx66-fv34-fjm8" }, { "ecosystem": "npm", "name": "@tanstack/solid-start", "vulnerable": ">= 1.143.12, < 1.168.57", "fixed": "1.168.57", "advisory": "GHSA-qx66-fv34-fjm8" }, { "ecosystem": "npm", "name": "@tanstack/vue-start", "vulnerable": ">= 1.143.12, < 1.168.56", "fixed": "1.168.56", "advisory": "GHSA-qx66-fv34-fjm8" } ], "vendor": "TanStack", "product": "router", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-qx66-fv34-fjm8" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-15T20:22:20.000Z", "updatedAt": "2026-10-15T20:22:20.000Z" }, { "id": "cve-2026-108261", "url": "https://cveboard.org/i/cve-2026-108261", "urlPt": "https://cveboard.org/pt/i/cve-2026-108261", "json": "https://cveboard.org/i/cve-2026-108261.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment", "summary": "The TinaCMS admin builds its preview