{"items":[{"id":"CVE-2026-104871","published":"2026-10-02T19:43:50.475Z","updated":"2026-10-02T20:12:49.364Z","title":"Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows","severity":"MEDIUM","score":6.3,"vendor":"angular","product":"angular-cli","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2026-44437","published":"2026-05-13T21:23:59.260Z","updated":"2026-05-14T13:35:18.562Z","title":"Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix","severity":"MEDIUM","score":6.9,"vendor":"angular","product":"angular-cli","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-33397","published":"2026-03-26T13:46:16.145Z","updated":"2026-03-30T14:56:05.822Z","title":"Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass","severity":"MEDIUM","score":6.9,"vendor":"angular","product":"angular-cli","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-27739","published":"2026-02-25T16:47:29.705Z","updated":"2026-02-27T17:59:11.328Z","title":"Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline","severity":"CRITICAL","score":9.2,"vendor":"angular","product":"angular-cli","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-27738","published":"2026-02-25T16:40:44.724Z","updated":"2026-02-27T20:46:26.917Z","title":"Angular SSR has an Open Redirect via X-Forwarded-Prefix","severity":"MEDIUM","score":6.9,"vendor":"angular","product":"angular-cli","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2025-62427","published":"2025-10-16T18:50:11.598Z","updated":"2025-10-17T13:24:15.389Z","title":"Server-Side Request Forgery (SSRF) in Angular SSR","severity":"HIGH","score":8.7,"vendor":"angular","product":"angular-cli","kev":false,"epss":0.00432,"kevAdded":null}]}