Login Request a demo
AN
Product
angular-cli
by angular · last CVE Oct 2, 2026
7
CVEs
0
On KEV
9.2
Max CVSS
1
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 2High 1Medium 4Low 0
Severity
All severities7Critical2High1Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add angular-cli to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-27739
9.2
1%
Feb 25
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
Affected: >= 21.2.0-next.2, < 21.2.0-rc.0; >= 21.0.0-next.0, < 21.1.5; >= 20.0.0-next.0, < 20.3.17; < 19.2.21
CVE-2026-32635
9.0
0%
Mar 13
Angular has XSS in i18n attribute bindings
Affected: 17.0.0 before 19.2.0; 20.0.0 through 20.3.18; 21.0.0 before 21.2.4; 22.0.0; 22.0.0
CVE-2025-62427
8.7
0%
Oct 16
Server-Side Request Forgery (SSRF) in Angular SSR
Affected: >=19.0.0-next.0, < 19.2.18; >=20.0.0-next.0, < 20.3.6; >=21.0.0-next.0, < 21.0.0-next.8
CVE-2026-27738
6.9
0%
Feb 25
Angular SSR has an Open Redirect via X-Forwarded-Prefix
Affected: >= 21.2.0-next.2, < 21.2.0-rc.0; >= 21.0.0-next.0, < 21.1.5; >= 20.0.0-next.0, < 20.3.17; >= 19.0.0-next.0, < 19.2.21
CVE-2026-104871
6.3
0%
Oct 2
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Affected: < 20.3.36; >= 21.0.0, < 21.2.23; >= 22.0.0, < 22.1.7
CVE-2026-44437
6.1
0%
May 13
Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Affected: >= 22.0.0-next.0, < 22.0.0-next.7; >= 21.0.0-next.0, < 21.2.9; >= 20.0.0-next.0, < 20.3.25; >= 19.0.0-next.0, < 19.2.25
CVE-2026-33397
6.1
0%
Mar 26
Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass
Affected: >= 22.0.0-next.0, < 22.0.0-next.2; >= 21.0.0-next.0, < 21.2.3; >= 20.0.0-next.0, < 20.3.21
Showing 7