Angular vulnerabilities

Products

• Angular 42
• Angular-cli 6
• Cli 3
• Language Service 2

Newest

• angular, angular devtools +1 more Angular DevTools (Local DoS) CVE-2026-101897 5.1 MediumOctober 14, 2026
• angular angular-cli Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows CVE-2026-104871 Fix available 6.3 MediumOctober 2, 2026
• @angular router, angular +1 more Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR) CVE-2026-101896 Fix available 8.2 HighSeptember 30, 2026
• @angular platform-server, angular +1 more Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE CVE-2026-101895 Fix available 8.7 HighSeptember 28, 2026
• angular Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVE-2026-88060 Fix available 8.6 HighSeptember 10, 2026
• angular Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent` CVE-2026-88059 Fix available 4.0 MediumSeptember 10, 2026
• angular Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVE-2026-88058 Fix available 8.6 HighSeptember 10, 2026
• angular Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler CVE-2026-88057 Fix available 5.3 MediumSeptember 10, 2026
• angular Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVE-2026-88056 Fix available 8.6 HighSeptember 10, 2026
• @angular compiler, angular, @angular core +2 more Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes CVE-2026-69151 Fix available 7.6 HighAugust 3, 2026
• @angular platform-server, angular +1 more Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) CVE-2026-69149 Fix available 8.6 HighAugust 3, 2026
• angular, @angular common +1 more Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning CVE-2026-68945 Fix available 8.8 HighAugust 3, 2026
• angular, angular language service, angular.ng-template +2 more Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension CVE-2026-50178 8.7 HighJune 22, 2026
• angular, angular language service +1 more Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension CVE-2026-49241 8.7 HighJune 22, 2026
• angular Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker CVE-2026-54264 Fix available 8.3 HighJune 15, 2026
• angular Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate) CVE-2026-54268 Fix available 8.2 HighJune 15, 2026
• angular Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning CVE-2026-54266 Fix available 8.8 HighJune 15, 2026
• angular Angular: Two-Way Property Binding Sanitization Bypass (XSS) CVE-2026-54265 Fix available 5.3 MediumJune 15, 2026
• angular Angular: Template and Attribute Namespace Sanitization Bypass (XSS) CVE-2026-50557 Fix available 5.3 MediumJune 15, 2026
• angular, red hat enterprise linux 8, fuse 7 +2 more Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR CVE-2026-50556 Fix available 8.6 HighJune 15, 2026
• angular Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server CVE-2026-50555 Fix available 8.6 HighJune 15, 2026
• angular Angular: Request Credential & Cache Policy Stripping in Angular Service Worker CVE-2026-50184 Fix available 5.7 MediumJune 15, 2026
• angular Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) CVE-2026-50171 Fix available 8.2 HighJune 15, 2026
• angular Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache CVE-2026-50170 Fix available 8.2 HighJune 15, 2026
• angular Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS) CVE-2026-52725 Fix available 5.3 MediumJune 15, 2026
• angular Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities CVE-2026-50169 Fix available 5.7 MediumJune 15, 2026
• angular Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass CVE-2026-50168 Fix available 8.8 HighJune 15, 2026
• angular Angular Client Hydration DOM Clobbering & Response-Cache Poisoning CVE-2026-54267 Fix available 8.6 HighJune 15, 2026
• angular, red hat enterprise linux 8, fuse 7 +2 more Angular: SSRF via Hostname Hijacking in @angular/platform-server CVE-2026-46417 Fix available 8.8 HighMay 19, 2026
• angular angular-cli, cli +1 more Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix CVE-2026-44437 Fix available 6.9 MediumMay 6, 2026
• angular Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server CVE-2026-41423 Fix available 8.7 HighApril 16, 2026
• angular angular-cli, cli +1 more Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass CVE-2026-33397 Fix available 6.9 MediumMarch 19, 2026
• @angular compiler, core, angular cli +2 more Angular has XSS in i18n attribute bindings CVE-2026-32635 Public exploitFix available 8.6 HighMarch 13, 2026
• angular, red hat advanced cluster management for kubernetes 2, enterprise linux 10 +5 more +7 more Angular i18n vulnerable to Cross-Site Scripting (XSS) CVE-2026-27970 Fix available 7.6 HighFebruary 26, 2026
• angular @nguniversal/common, @nguniversal/express-engine, angular-cli +2 more Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline CVE-2026-27739 Public exploitFix available 9.2 CriticalFebruary 25, 2026
• angular angular-cli Angular SSR has an Open Redirect via X-Forwarded-Prefix CVE-2026-27738 Fix available 6.9 MediumFebruary 25, 2026
• angular, siemens ruggedcom rst2428p, sidis prime +2 more Angular has XSS Vulnerability via Unsanitized SVG Script Attributes CVE-2026-22610 Public exploitFix available 8.5 HighJanuary 9, 2026
• angular, siemens ruggedcom rst2428p, sidis prime +2 more Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes CVE-2025-66412 Fix available 8.5 HighDecember 1, 2025
• angular, siemens ruggedcom rst2428p, sidis prime +2 more Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs CVE-2025-66035 Fix available 7.7 HighNovember 26, 2025
• angular, ckeditor ckeditor5 +1 more A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows... CVE-2025-61261 5.4 MediumNovember 7, 2025
• angular angular-cli Server-Side Request Forgery (SSRF) in Angular SSR CVE-2025-62427 Fix available 8.7 HighOctober 16, 2025
• angular Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage CVE-2025-59052 Fix available 7.1 HighSeptember 10, 2025
• angular, angularjs +1 more Angular Comment cross site scripting CVE-2021-4231 Fix available 3.5 LowMay 26, 2022
• angular, angularjs, fedoraproject fedora +1 more +3 more Regular Expression Denial of Service (ReDoS) CVE-2022-25844 Fix available 5.3 MediumMay 1, 2022
• angular, google angularjs, angularjs angular.js +2 more Cross-Site Scripting via JSONP CVE-2024-21490 Public exploitFix available 7.5 HighJune 27, 2019
• angular, angularjs, fedoraproject fedora +2 more Cross-Site Scripting via JSONP CVE-2023-26118 Fix available 5.3 MediumJune 27, 2019
• angular, angularjs, fedoraproject fedora +2 more Cross-Site Scripting via JSONP CVE-2023-26117 Fix available 5.3 MediumJune 27, 2019
• angular, angularjs, fedoraproject fedora +2 more Cross-Site Scripting via JSONP CVE-2023-26116 Fix available 5.3 MediumJune 27, 2019
• angular, angularjs +1 more Cross-Site Scripting via JSONP CVE-2022-25869 Public exploitFix available 4.2 MediumJune 27, 2019