CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 4,069 CVEs published, 327 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
4,069
Show in the list
Critical, last 7 days
327
Show in the list
Healthcare-tagged, last 7 days
9
Show in the list
Known exploited (CISA KEV)
1,756
Show in the list

Showing CVEs that name the product angular:angular. Show all products

34 CVEs, showing 1 to 34
CVESeverityTitlePublished
CVE-2026-101896High 8.2Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)
Assigned by GitHub_M
Oct 14, 2026
CVE-2026-101897Medium 5.1Angular DevTools (Local DoS)
Assigned by GitHub_M
Oct 14, 2026
CVE-2026-101895High 8.7Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
Assigned by GitHub_M
Oct 14, 2026
CVE-2026-88060High 8.6Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88059Medium 4.0Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88058High 8.6Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88057Medium 5.3Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88056High 8.6Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-69151High 7.6Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Assigned by GitHub_M
Aug 3, 2026
CVE-2026-69149High 8.6Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
Assigned by GitHub_M
Aug 3, 2026
CVE-2026-68945High 8.8Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
Assigned by GitHub_M
Aug 3, 2026
CVE-2026-50171High 8.2Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-50184Medium 5.7Angular: Request Credential & Cache Policy Stripping in Angular Service Worker
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-50169Medium 5.7Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-46417High 8.8Angular: SSRF via Hostname Hijacking in @angular/platform-server
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-50168High 8.8Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-50170High 8.2Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-50556High 8.6Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-50555High 8.6Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-54264High 8.3Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-54268High 8.2Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-54267High 8.6Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-54266High 8.8Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-54265Medium 5.3Angular: Two-Way Property Binding Sanitization Bypass (XSS)
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-50178High 8.7Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-52725Medium 5.3Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-49241High 8.7Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-50557Medium 5.3Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-41423High 8.7Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
Assigned by GitHub_M
May 8, 2026
CVE-2026-27970High 7.6Angular i18n vulnerable to Cross-Site Scripting (XSS)
Assigned by GitHub_M
Feb 25, 2026
CVE-2026-22610High 8.5Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
Assigned by GitHub_M
Jan 9, 2026
CVE-2025-66412High 8.5Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
Assigned by GitHub_M
Dec 1, 2025
CVE-2025-66035High 7.7Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs
Assigned by GitHub_M
Nov 26, 2025
CVE-2025-61261Medium 5.4A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payloa…
Assigned by mitre
Nov 6, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.