CVEs we hold for Angular

Records whose assigning authority named Angular as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-88060Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elementsangular

CVE-2026-88059Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`angular

CVE-2026-88058Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elementsangular

CVE-2026-88057Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and…angular

CVE-2026-88056Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSRangular

CVE-2026-69151Angular i18n: Cross-Site Scripting (XSS) via event-handler attributesangular; @angular compiler; @angular core

CVE-2026-69149Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)angular; @angular platform-server

CVE-2026-68945Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoningangular; @angular common

CVE-2026-54268Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)angular

CVE-2026-54267Angular Client Hydration DOM Clobbering & Response-Cache Poisoningangular

CVE-2026-54266Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoningangular

CVE-2026-54265Angular: Two-Way Property Binding Sanitization Bypass (XSS)angular

CVE-2026-54264Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Workerangular

CVE-2026-52725Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)angular

CVE-2026-50557Angular: Template and Attribute Namespace Sanitization Bypass (XSS)angular

CVE-2026-50556Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSRangular

CVE-2026-50555Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in…angular

CVE-2026-50184Angular: Request Credential & Cache Policy Stripping in Angular Service Workerangular

CVE-2026-50178Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extensionangular; angular Angular.ng-template

CVE-2026-50171Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)angular

CVE-2026-50170Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCacheangular

CVE-2026-50169Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilitiesangular

CVE-2026-50168Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypassangular

CVE-2026-49241Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extensionangular

CVE-2026-46417Angular: SSRF via Hostname Hijacking in @angular/platform-serverangular

CVE-2026-44437Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefixangular-cli

CVE-2026-41423Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Serverangular

CVE-2026-33397Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypassangular-cli

CVE-2026-27970Angular i18n vulnerable to Cross-Site Scripting (XSS)angular

CVE-2026-27739Angular SSR is vulnerable to SSRF and Header Injection via request handling pipelineangular-cli; angular @nguniversal/common…

CVE-2026-27738Angular SSR has an Open Redirect via X-Forwarded-Prefixangular-cli

CVE-2026-22610Angular has XSS Vulnerability via Unsanitized SVG Script Attributesangular

CVE-2025-66412Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributesangular

CVE-2025-66035Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLsangular

CVE-2025-62427Server-Side Request Forgery (SSRF) in Angular SSRangular-cli

CVE-2025-59052Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakageangular

CVE-2024-21490no title heldn/a angularjs

CVE-2023-26118no title heldn/a org.webjars.bowergithub.angular:angular

CVE-2023-26117no title heldn/a org.webjars.bowergithub.angular:angular

CVE-2023-26116no title heldn/a org.webjars.bowergithub.angular:angular

CVE-2022-25869no title heldn/a angularjs

CVE-2022-25844Regular Expression Denial of Service (ReDoS)n/a angular

CVE-2020-7676no title heldn/a angular.js

CVE-2019-10768no title heldn/a AngularJS

44 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.