{"items":[{"id":"CVE-2026-111753","published":"2026-11-05T20:25:07.322Z","updated":"2026-11-05T20:25:07.322Z","title":"Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)","severity":"MEDIUM","score":5.9,"vendor":"angular","product":"angular","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2026-111751","published":"2026-11-03T20:58:04.630Z","updated":"2026-11-03T20:58:04.630Z","title":"Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)","severity":"HIGH","score":8.2,"vendor":"angular","product":"angular","kev":false,"epss":0.00659,"kevAdded":null},{"id":"CVE-2026-111754","published":"2026-11-03T20:55:11.497Z","updated":"2026-11-03T21:23:55.644Z","title":"Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)","severity":"MEDIUM","score":5.1,"vendor":"angular","product":"angular","kev":false,"epss":0.00977,"kevAdded":null},{"id":"CVE-2026-111752","published":"2026-11-03T20:52:16.675Z","updated":"2026-11-03T20:52:16.675Z","title":"Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)","severity":"HIGH","score":8.2,"vendor":"angular","product":"angular","kev":false,"epss":0.00988,"kevAdded":null},{"id":"CVE-2026-101896","published":"2026-10-14T15:05:42.934Z","updated":"2026-10-20T01:32:46.385Z","title":"Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)","severity":"HIGH","score":8.2,"vendor":"angular","product":"angular","kev":false,"epss":0.00909,"kevAdded":null},{"id":"CVE-2026-101897","published":"2026-10-14T15:03:36.405Z","updated":"2026-10-29T14:40:53.404Z","title":"Angular DevTools (Local DoS)","severity":"MEDIUM","score":5.1,"vendor":"angular","product":"angular","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2026-101895","published":"2026-10-14T15:00:14.385Z","updated":"2026-10-14T17:38:10.017Z","title":"Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE","severity":"HIGH","score":8.7,"vendor":"angular","product":"angular","kev":false,"epss":0.00872,"kevAdded":null},{"id":"CVE-2026-104871","published":"2026-10-02T19:43:50.475Z","updated":"2026-10-02T20:12:49.364Z","title":"Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows","severity":"MEDIUM","score":6.3,"vendor":"angular","product":"angular-cli","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2026-88060","published":"2026-09-10T19:04:17.420Z","updated":"2026-09-10T19:20:56.297Z","title":"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements","severity":"HIGH","score":8.6,"vendor":"angular","product":"angular","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2026-88059","published":"2026-09-10T19:00:12.376Z","updated":"2026-09-11T17:50:22.562Z","title":"Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`","severity":"MEDIUM","score":4,"vendor":"angular","product":"angular","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2026-88058","published":"2026-09-10T18:56:03.369Z","updated":"2026-09-11T15:14:37.967Z","title":"Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements","severity":"HIGH","score":8.6,"vendor":"angular","product":"angular","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-88057","published":"2026-09-10T18:46:51.847Z","updated":"2026-09-11T20:32:49.884Z","title":"Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler","severity":"MEDIUM","score":5.3,"vendor":"angular","product":"angular","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-88056","published":"2026-09-10T18:42:34.054Z","updated":"2026-09-15T14:56:52.167Z","title":"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR","severity":"HIGH","score":8.6,"vendor":"angular","product":"angular","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2026-69151","published":"2026-08-03T16:23:34.121Z","updated":"2026-08-03T21:19:24.394Z","title":"Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes","severity":"HIGH","score":7.6,"vendor":"angular","product":"angular","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-69149","published":"2026-08-03T16:14:39.636Z","updated":"2026-08-03T20:33:46.327Z","title":"Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)","severity":"HIGH","score":8.6,"vendor":"angular","product":"angular","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2026-68945","published":"2026-08-03T15:58:02.299Z","updated":"2026-08-03T16:58:26.263Z","title":"Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning","severity":"HIGH","score":8.8,"vendor":"angular","product":"angular","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-50171","published":"2026-06-22T15:49:51.774Z","updated":"2026-06-23T16:02:07.902Z","title":"Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)","severity":"HIGH","score":8.2,"vendor":"angular","product":"angular","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-50184","published":"2026-06-22T15:42:05.167Z","updated":"2026-06-23T13:48:24.684Z","title":"Angular: Request Credential & Cache Policy Stripping in Angular Service Worker","severity":"MEDIUM","score":5.7,"vendor":"angular","product":"angular","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2026-50169","published":"2026-06-22T15:41:17.125Z","updated":"2026-06-22T17:32:36.408Z","title":"Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities","severity":"MEDIUM","score":5.7,"vendor":"angular","product":"angular","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-46417","published":"2026-06-22T15:40:32.527Z","updated":"2026-07-15T00:50:25.196Z","title":"Angular: SSRF via Hostname Hijacking in @angular/platform-server","severity":"HIGH","score":8.8,"vendor":"angular","product":"angular","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2026-50168","published":"2026-06-22T15:39:46.193Z","updated":"2026-06-22T17:59:49.283Z","title":"Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass","severity":"HIGH","score":8.8,"vendor":"angular","product":"angular","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-50170","published":"2026-06-22T15:39:08.877Z","updated":"2026-06-23T16:00:21.739Z","title":"Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache","severity":"HIGH","score":8.2,"vendor":"angular","product":"angular","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-50556","published":"2026-06-22T15:38:28.166Z","updated":"2026-07-15T00:46:49.620Z","title":"Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR","severity":"HIGH","score":8.6,"vendor":"angular","product":"angular","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-50555","published":"2026-06-22T15:37:29.943Z","updated":"2026-06-22T17:58:33.065Z","title":"Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server","severity":"HIGH","score":8.6,"vendor":"angular","product":"angular","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-54264","published":"2026-06-22T15:32:48.163Z","updated":"2026-06-23T13:46:25.169Z","title":"Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker","severity":"HIGH","score":8.3,"vendor":"angular","product":"angular","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2026-54268","published":"2026-06-22T15:31:47.836Z","updated":"2026-06-23T16:09:21.239Z","title":"Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)","severity":"HIGH","score":8.2,"vendor":"angular","product":"angular","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-54267","published":"2026-06-22T15:30:48.699Z","updated":"2026-06-22T16:00:36.910Z","title":"Angular Client Hydration DOM Clobbering & Response-Cache Poisoning","severity":"HIGH","score":8.6,"vendor":"angular","product":"angular","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2026-54266","published":"2026-06-22T15:28:42.561Z","updated":"2026-06-22T17:56:12.976Z","title":"Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning","severity":"HIGH","score":8.8,"vendor":"angular","product":"angular","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-54265","published":"2026-06-22T15:27:38.802Z","updated":"2026-06-22T15:54:58.231Z","title":"Angular: Two-Way Property Binding Sanitization Bypass (XSS)","severity":"MEDIUM","score":5.3,"vendor":"angular","product":"angular","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-50178","published":"2026-06-22T15:20:39.800Z","updated":"2026-06-22T16:04:50.886Z","title":"Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension","severity":"HIGH","score":8.7,"vendor":"angular","product":"angular","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-52725","published":"2026-06-22T15:18:43.036Z","updated":"2026-06-22T15:59:33.229Z","title":"Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)","severity":"MEDIUM","score":5.3,"vendor":"angular","product":"angular","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-49241","published":"2026-06-22T15:16:14.945Z","updated":"2026-06-23T13:42:26.808Z","title":"Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension","severity":"HIGH","score":8.7,"vendor":"angular","product":"angular","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-50557","published":"2026-06-22T15:11:48.347Z","updated":"2026-06-22T17:54:55.320Z","title":"Angular: Template and Attribute Namespace Sanitization Bypass (XSS)","severity":"MEDIUM","score":5.3,"vendor":"angular","product":"angular","kev":false,"epss":0.00411,"kevAdded":null},{"id":"CVE-2026-44437","published":"2026-05-13T21:23:59.260Z","updated":"2026-05-14T13:35:18.562Z","title":"Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix","severity":"MEDIUM","score":6.9,"vendor":"angular","product":"angular-cli","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-41423","published":"2026-05-08T13:06:59.289Z","updated":"2026-05-08T14:22:05.978Z","title":"Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server","severity":"HIGH","score":8.7,"vendor":"angular","product":"angular","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-33397","published":"2026-03-26T13:46:16.145Z","updated":"2026-03-30T14:56:05.822Z","title":"Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass","severity":"MEDIUM","score":6.9,"vendor":"angular","product":"angular-cli","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-27970","published":"2026-02-26T02:03:43.811Z","updated":"2026-07-15T01:12:09.680Z","title":"Angular i18n vulnerable to Cross-Site Scripting (XSS)","severity":"HIGH","score":7.6,"vendor":"angular","product":"angular","kev":false,"epss":0.00547,"kevAdded":null},{"id":"CVE-2026-27739","published":"2026-02-25T16:47:29.705Z","updated":"2026-02-27T17:59:11.328Z","title":"Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline","severity":"CRITICAL","score":9.2,"vendor":"angular","product":"angular-cli","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-27738","published":"2026-02-25T16:40:44.724Z","updated":"2026-02-27T20:46:26.917Z","title":"Angular SSR has an Open Redirect via X-Forwarded-Prefix","severity":"MEDIUM","score":6.9,"vendor":"angular","product":"angular-cli","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2026-22610","published":"2026-01-10T03:35:40.727Z","updated":"2026-06-02T13:00:45.332Z","title":"Angular has XSS Vulnerability via Unsanitized SVG Script Attributes","severity":"HIGH","score":8.5,"vendor":"angular","product":"angular","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2025-66412","published":"2025-12-01T22:35:59.211Z","updated":"2026-06-02T13:00:31.963Z","title":"Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes","severity":"HIGH","score":8.5,"vendor":"angular","product":"angular","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2025-66035","published":"2025-11-26T22:18:35.692Z","updated":"2026-06-02T13:00:29.580Z","title":"Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs","severity":"HIGH","score":7.7,"vendor":"angular","product":"angular","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2025-62427","published":"2025-10-16T18:50:11.598Z","updated":"2025-10-17T13:24:15.389Z","title":"Server-Side Request Forgery (SSRF) in Angular SSR","severity":"HIGH","score":8.7,"vendor":"angular","product":"angular-cli","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2025-59052","published":"2025-09-10T20:13:56.965Z","updated":"2025-09-10T20:25:32.147Z","title":"Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage","severity":"HIGH","score":7.1,"vendor":"angular","product":"angular","kev":false,"epss":0.00355,"kevAdded":null}]}