Login Request a demo
AN
Product
angular
by angular · last CVE Oct 14, 2026
34
CVEs
0
On KEV
9.1
Max CVSS
3
New 30D
Vulnerabilities34In the news1Timeline
Severity mix
Critical 1High 7Medium 26Low 0
Severity
All severities34Critical1High7Medium26Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add angular to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-88056
9.1
1%
Sep 10
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Affected: <= 19.2.25; >= 20.0.0, < 20.3.30; >= 21.0.0, < 21.2.22; >= 22.0.0, < 22.1.4
CVE-2026-50178
8.8
1%
Jun 22
Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension
Affected: < 21.2.4
CVE-2026-49241
8.8
0%
Jun 22
Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension
Affected: < 21.2.4
CVE-2026-101895
8.7
1%
Oct 14
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
Affected: <= 19.2.25; >= 20.0.0, < 20.3.31; >= 21.0.0, < 21.2.23; >= 22.0.0, < 22.1.6
CVE-2026-101896
8.2
1%
Oct 14
Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)
Affected: <= 19.2.25; >= 20.0.0, < 20.3.32; >= 21.0.0, < 21.2.24; >= 22.0.0, < 22.2.0
CVE-2026-50168
8.2
0%
Jun 22
Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
Affected: >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.15; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14
CVE-2026-50170
7.5
0%
Jun 22
Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
Affected: >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.15; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14
CVE-2026-54268
7.5
1%
Jun 22
Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
Affected: >= 22.0.0-next.0 < 22.0.1; >= 21.0.0-next.0 < 21.2.17; >= 20.0.0-next.0 < 20.3.25; <= 19.2.25
CVE-2026-88060
6.1
0%
Sep 10
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
Affected: <= 19.2.25; >= 20.0.0, < 20.3.30; >= 21.0.0, < 21.2.22; >= 22.0.0, < 22.1.4
CVE-2026-88058
6.1
0%
Sep 10
Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
Affected: <= 19.2.25; >= 20.0.0, < 20.3.30; >= 21.0.0, < 21.2.22; >= 22.0.0, < 22.1.4
CVE-2026-88057
6.1
0%
Sep 10
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Affected: <= 19.2.25; >= 20.0.0, < 20.3.28; >= 21.0.0, < 21.2.20; >= 22.0.0, < 22.1.0
CVE-2026-69151
6.1
0%
Aug 3
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Affected: >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.19; < 20.3.27
CVE-2026-69149
6.1
0%
Aug 3
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
Affected: < 20.3.27; >= 21.0.0-next.0, < 21.2.19; >= 22.0.0-next.0, < 22.0.7
CVE-2026-68945
6.1
0%
Aug 3
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
Affected: < 20.3.27; >= 21.0.0-next.0, < 21.2.19; >= 22.0.0-next.0, < 22.0.2
CVE-2026-50171
6.1
0%
Jun 22
Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
Affected: >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.15; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14
CVE-2026-50184
6.1
0%
Jun 22
Angular: Request Credential & Cache Policy Stripping in Angular Service Worker
Affected: >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.15; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14
CVE-2026-50169
6.1
0%
Jun 22
Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
Affected: >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.15; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14
CVE-2026-46417
6.1
0%
Jun 22
Angular: SSRF via Hostname Hijacking in @angular/platform-server
Affected: >= 22.0.0-next.0, < 22.0.0-next.12; >= 21.0.0-next.0, < 21.2.13; >= 20.0.0-next.0, < 20.3.21; >= 19.0.0-next.0, < 19.2.22; <= 18.2.14
CVE-2026-50556
6.1
0%
Jun 22
Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
Affected: >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.16; >= 20.0.0-next.0, < 20.3.24; >= 19.0.0-next.0, < 19.2.25; <= 18.2.14
CVE-2026-50555
6.1
0%
Jun 22
Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server
Affected: >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.16; >= 20.0.0-next.0, < 20.3.24; >= 19.0.0-next.0, < 19.2.25; <= 18.2.14
CVE-2026-54264
6.1
0%
Jun 22
Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
Affected: >= 22.0.0-next.0 < 22.0.1; >= 21.0.0-next.0 < 21.2.17; >= 20.0.0-next.0 < 20.3.25; <= 19.2.25
CVE-2026-54267
6.1
0%
Jun 22
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
Affected: >= 22.0.0-next.0 < 22.0.1; >= 21.0.0-next.0 < 21.2.17; >= 20.0.0-next.0 < 20.3.25; <= 19.2.25
CVE-2026-54266
6.1
0%
Jun 22
Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
Affected: >= 22.0.0-next.0 < 22.0.1; >= 21.0.0-next.0 < 21.2.17; >= 20.0.0-next.0 < 20.3.25; <= 19.2.25
CVE-2026-54265
6.1
0%
Jun 22
Angular: Two-Way Property Binding Sanitization Bypass (XSS)
Affected: >= 22.0.0-next.0 < 22.0.1; >= 21.0.0-next.0 < 21.2.17; >= 20.0.0-next.0 < 20.3.25; <= 19.2.25
CVE-2026-52725
6.1
0%
Jun 22
Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
Affected: >= 22.0.0-next.0 < 22.0.0-rc.2; >= 21.0.0-next.0 < 21.2.15; >= 20.0.0-next.0 < 20.3.22; >= 19.0.0-next.0 < 19.2.22; <= 18.2.14
CVE-2026-50557
6.1
0%
Jun 22
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
Affected: >= 21.0.0-next.0 < 21.2.15; >= 22.0.0-next.0 < 22.0.0-rc.2; >= 20.0.0-next.0 < 20.3.22; >= 19.0.0-next.0 < 19.2.22; <= 18.2.14
CVE-2026-27970
6.1
1%
Feb 26
Angular i18n vulnerable to Cross-Site Scripting (XSS)
Affected: >= 21.2.0-next.0, < 21.2.0; >= 21.0.0-next.0, < 21.1.6; >= 20.0.0-next.0, < 20.3.17; >= 19.0.0-next.0, < 19.2.19; <= 18.2.14
CVE-2026-22610
6.1
0%
Jan 10
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
Affected: >= 21.1.0-next.0, < 21.1.0-rc.0; >= 21.0.0-next.0, < 21.0.7; >= 20.0.0-next.0, < 20.3.16; < 19.2.18
CVE-2026-88059
5.8
0%
Sep 10
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
Affected: <= 19.2.25; >= 20.0.0, < 20.3.28; >= 21.0.0, < 21.2.20; >= 22.0.0, < 22.1.1
CVE-2025-66412
5.4
0%
Dec 1
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
Affected: through 18.2.14; 19.0.0 before 19.2.17; 20.0.0 before 20.3.15; 21.0.0 before 21.0.2
CVE-2025-61261
5.4
0%
Nov 7
A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via…
Affected: 18.0.0
CVE-2021-4231
5.4
1%
May 26
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2
Affected: 11.1.0; 11.1.0; 11.1.0
CVE-2026-41423
5.3
0%
May 8
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
Affected: < 19.2.21; >= 20.0.0-next.0, < 20.3.19; >= 21.0.0-next.0, < 21.2.9; >= 22.0.0-next.0, < 22.0.0-next.8
CVE-2026-101897
5.1
0%
Oct 14
Angular DevTools (Local DoS)
Affected: < 22.2.0-rc.0
Showing 34