Skip to content

Commit b4b4425

Browse files
deleoniodeleonio
committed
Merge branch 'develop' of https://github.com/public-ui/kolibri into fix/9729-tabs-multiple-selected
2 parents 3ac72d7 + 61bcdc7 commit b4b4425

File tree

601 files changed

+19280
-35096
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

601 files changed

+19280
-35096
lines changed

‎docs/CVE_OVERVIEW.md‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,9 @@
3131
| Severity | v4 | v3 | v2 | v1 |
3232
| -------- | --: | --: | --: | --: |
3333
| critical | 3 | 3 | 3 | 1 |
34-
| high | 14 | 15 | 21 | 17 |
35-
| moderate | 3 | 2 | 11 | 1 |
36-
| low | 2 | 2 | 7 | 0 |
34+
| high | 17 | 17 | 27 | 20 |
35+
| moderate | 1 | 2 | 13 | 1 |
36+
| low | 3 | 3 | 8 | 0 |
3737
| info | 0 | 0 | 0 | 0 |
3838
| unknown | 0 | 0 | 0 | 0 |
3939

@@ -49,24 +49,33 @@
4949
| @angular/compiler | high | CVE-2026-22610 | v1 | Angular has XSS Vulnerability via Unsanitized SVG Script Attributes |
5050
| @angular/core | high | CVE-2026-22610 | v1 | Angular has XSS Vulnerability via Unsanitized SVG Script Attributes |
5151
| @angular/core | high | CVE-2026-27970 | v1 | Angular i18n vulnerable to Cross-Site Scripting |
52+
| @hono/node-server | high | CVE-2026-29087 | v2 | @hono/node-server has authorization bypass for protected static paths via encode |
5253
| axios | high | CVE-2026-25639 | v3, v2 | Axios is Vulnerable to Denial of Service via **proto** Key in mergeConfig |
5354
| braces | high | CVE-2024-4068 | v4, v3, v2, v1 | Uncontrolled resource consumption in braces |
55+
| express-rate-limit | high | CVE-2026-30827 | v2 | express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting o |
5456
| fast-xml-parser | high | CVE-2026-25128 | v4, v3, v2 | fast-xml-parser has RangeError DoS Numeric Entities Bug |
5557
| fast-xml-parser | high | CVE-2026-26278 | v4, v3, v2 | fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansio |
58+
| hono | high | CVE-2026-29045 | v2 | Hono vulnerable to arbitrary file access via serveStatic vulnerability |
59+
| immutable | high | CVE-2026-29063 | v2 | Immutable is vulnerable to Prototype Pollution |
60+
| locutus | high | CVE-2026-29091 | v4, v3, v2, v1 | locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Co |
5661
| lodash.pick | high | CVE-2020-8203 | v2, v1 | Prototype Pollution in lodash |
5762
| minimatch | high | CVE-2026-27903 | v4, v3, v2, v1 | minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja |
5863
| minimatch | high | CVE-2026-27904 | v4, v3, v2, v1 | minimatch ReDoS: nested \*() extglobs generate catastrophically backtracking regu |
5964
| minimatch | high | CVE-2026-26996 | v4, v3, v2 | minimatch has a ReDoS via repeated wildcards with non-matching literal in patter |
60-
| rollup | high | CVE-2026-27606 | v4, v3, v1 | Rollup 4 has Arbitrary File Write via Path Traversal |
65+
| rollup | high | CVE-2026-27606 | v1 | Rollup 4 has Arbitrary File Write via Path Traversal |
6166
| semver | high | CVE-2022-25883 | v2 | semver vulnerable to Regular Expression Denial of Service |
6267
| serialize-javascript | high | GHSA-5c6j-r48x-rmvq | v4, v3, v2, v1 | Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.to |
68+
| svgo | high | CVE-2026-29074 | v4, v3, v2, v1 | SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) |
6369
| tar | high | CVE-2026-23950 | v1 | Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on |
6470
| tar | high | CVE-2026-24842 | v1 | node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Trave |
6571
| tar | high | CVE-2026-23745 | v1 | node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Ins |
66-
| tar | high | CVE-2026-26960 | v4, v3, v2, v1 | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in no |
67-
| ajv | moderate | CVE-2025-69873 | v4, v3, v2 | ajv has ReDoS when using `$data` option |
72+
| tar | high | CVE-2026-26960 | v4, v3, v1 | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in no |
73+
| tar | high | CVE-2026-29786 | v4, v3, v2, v1 | tar has Hardlink Path Traversal via Drive-Relative Linkpath |
74+
| ajv | moderate | CVE-2025-69873 | v3, v2 | ajv has ReDoS when using `$data` option |
6875
| ejs | moderate | CVE-2024-33883 | v2 | ejs lacks certain pollution protection |
6976
| esbuild | moderate | GHSA-67mh-4wv8-2f99 | v2 | esbuild enables any website to send any requests to the development server and r |
77+
| hono | moderate | CVE-2026-29086 | v2 | Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in |
78+
| hono | moderate | CVE-2026-29085 | v2 | Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE() |
7079
| js-yaml | moderate | CVE-2025-64718 | v2 | js-yaml has prototype pollution in merge (<<) |
7180
| micromatch | moderate | CVE-2024-4067 | v4, v3, v2, v1 | Regular Expression Denial of Service (ReDoS) in micromatch |
7281
| nanoid | moderate | CVE-2024-55565 | v2 | Predictable results in nanoid generation when given non-integer values |
@@ -75,6 +84,7 @@
7584
| webpack | moderate | CVE-2024-43788 | v2 | Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to |
7685
| webpack-dev-server | moderate | CVE-2025-30360 | v2 | webpack-dev-server users' source code may be stolen when they access a malicious |
7786
| webpack-dev-server | moderate | CVE-2025-30359 | v2 | webpack-dev-server users' source code may be stolen when they access a malicious |
87+
| @tootallnate/once | low | CVE-2026-3449 | v4, v3, v2 | @tootallnate/once vulnerable to Incorrect Control Flow Scoping |
7888
| diff | low | CVE-2026-24001 | v4, v3, v2 | jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch |
7989
| fast-xml-parser | low | CVE-2026-27942 | v4, v3, v2 | fast-xml-parser has stack overflow in XMLBuilder with preserveOrder |
8090
| hono | low | GHSA-gq3j-xvxp-8hrf | v2 | Hono added timing comparison hardening in basicAuth and bearerAuth |

0 commit comments

Comments
 (0)
⚡