Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 84

Reset filters

Medium 20.10.2026

CVE-2026-111753

@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

A URL parsing discrepancy in the Angular HTTP client can cause cross-site request forgery tokens to leak to external domains during mutating requests. Attackers can leverage these leaked tokens to execute unauthorized actions against an authenticated user session.

High 20.10.2026

CVE-2026-111752

@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

A denial-of-service vulnerability in Angular Router affects Server-Side Rendering (SSR) on Node.js. Unauthenticated remote attackers can send crafted URLs with empty-path outlet segments to exhaust memory heap or CPU resources, causing worker process crashes and service disruption.

Medium 20.10.2026

CVE-2026-111754

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

An open redirect vulnerability in Angular Server-Side Rendering allows unauthenticated attackers to supply crafted dot-segments that bypass URL checks and redirect users off-origin.

High 08.10.2026

CVE-2026-107303

JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob

Medium 05.10.2026

CVE-2026-104871

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

Critical 02.10.2026

CVE-2026-10032

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

High 30.09.2026

CVE-2026-101896

Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

High 28.09.2026

CVE-2026-101895

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

High 28.09.2026

CVE-2026-88058

Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

High 10.09.2026

CVE-2026-88060

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

High 10.09.2026

CVE-2026-88056

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Medium 10.09.2026

CVE-2026-88059

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

Medium 10.09.2026

CVE-2026-88057

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

High 03.08.2026

CVE-2026-69151

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

High 03.08.2026

CVE-2026-69149

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

High 03.08.2026

CVE-2026-68945

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

High 24.06.2026

CVE-2026-11998

Angular's deprecated package has a Cross-Site Scripting issue

Low 15.06.2026

CVE-2026-65900

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

Medium 15.06.2026

CVE-2026-49459

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

High 15.06.2026

CVE-2026-54264

@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

High 15.06.2026

CVE-2026-54268

@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

High 15.06.2026

CVE-2026-54266

@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

Medium 15.06.2026

CVE-2026-54265

@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

Medium 15.06.2026

CVE-2026-50557

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

Showing 1 to 24 of 84 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 84

Know which vulnerabilities affect your application

Application security in your inbox