Log in Start free

@angular

Products

ProductCVEsExploitedLatest
angular38–Nov 5, 2026
angular-cli6–Oct 2, 2026
core2–Aug 3, 2026
compiler2–Aug 3, 2026
platform-server2–Oct 14, 2026
Angular.ng-template1–Jun 22, 2026
DevTools1–Oct 14, 2026
@nguniversal/common1–Feb 25, 2026
@nguniversal/express-engine1–Feb 25, 2026
common1–Aug 3, 2026
router1–Oct 14, 2026

Exploited and recent CVEs

  • CVE-2026-111753 Medium 5.9 Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035) 0.5%
  • CVE-2026-111751 High 8.2 Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR) 0.7%
  • CVE-2026-111754 Medium 5.1 Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) 1.0%
  • CVE-2026-111752 High 8.2 Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) 1.0%
  • CVE-2026-101896 High 8.2 Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR) 0.9%
  • CVE-2026-101896 High 8.2 Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR) 0.9%
  • CVE-2026-101897 Medium 5.1 Angular DevTools (Local DoS) 0.4%
  • CVE-2026-101897 Medium 5.1 Angular DevTools (Local DoS) 0.4%
  • CVE-2026-101895 High 8.7 Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE 0.9%
  • CVE-2026-101895 High 8.7 Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE 0.9%
  • CVE-2026-104871 Medium 6.3 Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows 0.4%
  • CVE-2026-88060 High 8.6 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements 0.4%
  • CVE-2026-88059 Medium 4.0 Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent` 0.3%
  • CVE-2026-88058 High 8.6 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements 0.3%
  • CVE-2026-88057 Medium 5.3 Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler 0.4%
  • CVE-2026-88056 High 8.6 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR 0.5%
  • CVE-2026-69151 High 7.6 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes 0.3%
  • CVE-2026-69151 High 7.6 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes 0.3%
  • CVE-2026-69151 High 7.6 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes 0.3%
  • CVE-2026-69149 High 8.6 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) 0.4%
  • CVE-2026-69149 High 8.6 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) 0.4%
  • CVE-2026-68945 High 8.8 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning 0.2%
  • CVE-2026-68945 High 8.8 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning 0.2%
  • CVE-2026-50171 High 8.2 Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) 0.3%
  • CVE-2026-50184 Medium 5.7 Angular: Request Credential & Cache Policy Stripping in Angular Service Worker 0.2%
  • CVE-2026-50169 Medium 5.7 Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities 0.2%
  • CVE-2026-46417 High 8.8 Angular: SSRF via Hostname Hijacking in @angular/platform-server 0.4%
  • CVE-2026-50168 High 8.8 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass 0.2%
  • CVE-2026-50170 High 8.2 Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache 0.4%
  • CVE-2026-50556 High 8.1 Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR 0.4%