angular

Records47All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high30CVSS 7.0–8.9

Exploited now

angular records in CISA KEV

No angular vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Angular 29 records HIGH Angular Cli 3 records MEDIUM Angular Language Service 2 records MEDIUM

Records

47 records

TI-2026-74069 CVE-2026-101895

Infinite loop in Angular SSR HTML parser allows denial of service

HIGH 77

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00872 Published 2026-10-14 Fixed in 20.3.31, 21.2.23 +1 CWE-400

TI-2026-60076 CVE-2026-88056 · GHSA-f6mr-pjwc-34m4

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

HIGH 76

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00541 Published 2026-09-10 Fixed in 20.3.30, 21.2.22 +1 CWE-918

TI-2026-60080 CVE-2026-88060 · GHSA-v3p8-whq6-r5jg

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

HIGH 72

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00362 Published 2026-09-10 Partial fix · 20.3.30, 21.2.22 +1 CWE-116

TI-2026-60078 CVE-2026-88058 · GHSA-j3r3-mxqp-r2p4

Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

HIGH 72

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00281 Published 2026-09-10 Fixed in 20.3.30, 21.2.22 +1 CWE-116

TI-2025-38694 CVE-2025-62427 · GHSA-q63q-pgmf-mxhr

Server-Side Request Forgery (SSRF) in Angular SSR

HIGH 71

The Angular SSR is a server-rise rendering tool for Angular applications.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00432 Published 2025-10-16 Fixed in 19.2.18, 20.3.6 +1 CWE-918

TI-2026-22098 CVE-2026-27738 · GHSA-xh43-g2fq-wjrj

Angular SSR has an Open Redirect via X-Forwarded-Prefix

HIGH 70

The Angular SSR is a server-rise rendering tool for Angular applications.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0035 Published 2026-02-25 Fixed in 21.2.0-rc.0, 21.1.5 +3 CWE-601

TI-2025-37971 CVE-2025-61261 · GHSA-fx2p-cf25-w3gm

A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular…

MEDIUM 58

A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00285 Published 2025-11-07 No fix listed CWE-79

TI-2026-22099 CVE-2026-27739 · GHSA-x288-3778-4hhx

Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

MEDIUM 46

The Angular SSR is a server-rise rendering tool for Angular applications.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00553 Published 2026-02-25 Fixed in 21.2.0-rc.0, 21.1.5 +3 CWE-918

TI-2026-36931 CVE-2026-50168 · GHSA-xrxm-cp7j-8xf6

Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass

MEDIUM 44

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00237 Published 2026-06-22 Fixed in 22.0.0-rc.2, 21.2.15 +2 CWE-346

TI-2026-34131 CVE-2026-46417 · GHSA-rfh7-fxqc-q52v

Angular: SSRF via Hostname Hijacking in @angular/platform-server

MEDIUM 44

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00361 Published 2026-06-22 Partial fix · 22.0.0-next.12, 21.2.13 +2 CWE-918

TI-2026-84802 CVE-2026-111751

Denial of service in Angular SSR via RouterLink query parameters

MEDIUM 43

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00659 Published 2026-11-03 Fixed in 21.2.25, 22.2.1 CWE-400

TI-2026-74070 CVE-2026-101896

Denial of service in Angular SSR via numeric URL matrix parameters

MEDIUM 43

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00909 Published 2026-10-14 Fixed in 20.3.32, 21.2.24 +1 CWE-400

TI-2026-48469 CVE-2026-68945 · GHSA-jhpw-976m-542j

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

MEDIUM 43

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00177 Published 2026-08-03 Partial fix · 20.3.27, 21.2.19 +1 CWE-345

TI-2026-39166 CVE-2026-54266 · GHSA-39pv-4j6c-2g6v

Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

MEDIUM 43

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00127 Published 2026-06-22 Fixed in 22.0.1, 21.2.17 +1 CWE-328

TI-2026-30022 CVE-2026-41423 · GHSA-45q2-gjvg-7973

Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

MEDIUM 43

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00305 Published 2026-05-08 Partial fix · 19.2.21, 20.3.19 +2 CWE-918

TI-2025-40561 CVE-2025-66035 · GHSA-58c5-g7wp-6w37

Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs

MEDIUM 41

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00716 Published 2025-11-26 Partial fix · 21.0.1, 20.3.14 +1 CWE-201

TI-2026-36937 CVE-2026-50178

Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension

MEDIUM 40

The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00502 Published 2026-06-22 Fixed in 21.2.4 CWE-79

TI-2026-25144 CVE-2026-32635 · GHSA-g93w-mfhg-p222

Angular has XSS in i18n attribute bindings

MEDIUM 40

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00473 Published 2026-03-13 Partial fix · 22.0.0-next.3, 21.2.4 +2 CWE-79

TI-2026-39167 CVE-2026-54267 · GHSA-rgjc-h3x7-9mwg

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

LOW 39

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00379 Published 2026-06-22 Fixed in 22.0.1, 21.2.17 +1 CWE-471

TI-2026-37278 CVE-2026-50556 · GHSA-gxx4-3xcv-f8qx

Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR

LOW 39

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00412 Published 2026-06-22 Fixed in 22.0.0-rc.2, 21.2.16 +2 CWE-79

TI-2026-37277 CVE-2026-50555 · GHSA-hqr9-c56f-3x7f

Cross-site scripting in angular

LOW 39

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00267 Published 2026-06-22 Fixed in 22.0.0-rc.2, 21.2.16 +2 CWE-79

TI-2026-36439 CVE-2026-49241

Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension

LOW 39

The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00242 Published 2026-06-22 Fixed in 21.2.4 CWE-427

TI-2026-18171 CVE-2026-22610 · GHSA-jrmj-c5cx-3cw6

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

LOW 39

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00439 Published 2026-01-10 Partial fix · 21.1.0-rc.0, 21.0.7 +2 CWE-79

TI-2026-84798 CVE-2026-111752

Denial of service in Angular router during server-side rendering

LOW 38

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00988 Published 2026-11-03 Fixed in 20.3.33, 21.2.25 +1 CWE-400

TI-2026-48530 CVE-2026-69149 · GHSA-vpx6-8pjr-4g3v

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

LOW 38

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00418 Published 2026-08-03 Fixed in 20.3.27, 21.2.19 +1 CWE-79

Open these records in search →

Critical	1
High	30
Medium	16
Low	0
No CVSS	0