# cve.now: Angular The newest entries naming Angular as an affected vendor (up to 200), of 45 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-111753](https://cve.now/CVE-2026-111753.md): Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035) (CVSS 5.9) - [CVE-2026-111751](https://cve.now/CVE-2026-111751.md): Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR) (CVSS 8.2) - [CVE-2026-111754](https://cve.now/CVE-2026-111754.md): Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) (CVSS 5.1) - [CVE-2026-111752](https://cve.now/CVE-2026-111752.md): Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) (CVSS 8.2) - [CVE-2026-101896](https://cve.now/CVE-2026-101896.md): Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR) (CVSS 8.2) - [CVE-2026-101897](https://cve.now/CVE-2026-101897.md): Angular DevTools (Local DoS) (CVSS 5.1) - [CVE-2026-101895](https://cve.now/CVE-2026-101895.md): Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE (CVSS 8.7) - [CVE-2026-104871](https://cve.now/CVE-2026-104871.md): Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows (CVSS 6.3) - [CVE-2026-88060](https://cve.now/CVE-2026-88060.md): Angular: SSR XSS via Unescaped \ Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements (CVSS 8.6) - [CVE-2026-88059](https://cve.now/CVE-2026-88059.md): Angular: Information Leak via \`HttpTransferCache\` Bypass When Using \`withRequestsMadeViaParent\` (CVSS 4.0) - [CVE-2026-88058](https://cve.now/CVE-2026-88058.md): Angular: SSR XSS via Unescaped Processing Instruction (\) Nodes in Fallback Raw-Content Elements (CVSS 8.6) - [CVE-2026-88057](https://cve.now/CVE-2026-88057.md): Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler (CVSS 5.3) - [CVE-2026-88056](https://cve.now/CVE-2026-88056.md): Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR (CVSS 8.6) - [CVE-2026-69151](https://cve.now/CVE-2026-69151.md): Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes (CVSS 7.6) - [CVE-2026-69149](https://cve.now/CVE-2026-69149.md): Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) (CVSS 8.6) - [CVE-2026-68945](https://cve.now/CVE-2026-68945.md): Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning (CVSS 8.8) - [CVE-2026-50171](https://cve.now/CVE-2026-50171.md): Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) (CVSS 8.2) - [CVE-2026-50184](https://cve.now/CVE-2026-50184.md): Angular: Request Credential & Cache Policy Stripping in Angular Service Worker (CVSS 5.7) - [CVE-2026-50169](https://cve.now/CVE-2026-50169.md): Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities (CVSS 5.7) - [CVE-2026-46417](https://cve.now/CVE-2026-46417.md): Angular: SSRF via Hostname Hijacking in @angular/platform-server (CVSS 8.8) - [CVE-2026-50168](https://cve.now/CVE-2026-50168.md): Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass (CVSS 8.8) - [CVE-2026-50170](https://cve.now/CVE-2026-50170.md): Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache (CVSS 8.2) - [CVE-2026-50556](https://cve.now/CVE-2026-50556.md): Angular: Missing \`\\` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR (CVSS 8.6) - [CVE-2026-50555](https://cve.now/CVE-2026-50555.md): Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server (CVSS 8.6) - [CVE-2026-54264](https://cve.now/CVE-2026-54264.md): Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker (CVSS 8.3) - [CVE-2026-54268](https://cve.now/CVE-2026-54268.md): Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate) (CVSS 8.2) - [CVE-2026-54267](https://cve.now/CVE-2026-54267.md): Angular Client Hydration DOM Clobbering & Response-Cache Poisoning (CVSS 8.6) - [CVE-2026-54266](https://cve.now/CVE-2026-54266.md): Angular: Weak 32-Bit Cache Key Hashing in \`HttpTransferCache\` Leading to Cross-Request Data Leakage and State Poisoning (CVSS 8.8) - [CVE-2026-54265](https://cve.now/CVE-2026-54265.md): Angular: Two-Way Property Binding Sanitization Bypass (XSS) (CVSS 5.3) - [CVE-2026-50178](https://cve.now/CVE-2026-50178.md): Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension (CVSS 8.7) - [CVE-2026-52725](https://cve.now/CVE-2026-52725.md): Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS) (CVSS 5.3) - [CVE-2026-49241](https://cve.now/CVE-2026-49241.md): Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension (CVSS 8.7) - [CVE-2026-50557](https://cve.now/CVE-2026-50557.md): Angular: Template and Attribute Namespace Sanitization Bypass (XSS) (CVSS 5.3) - [CVE-2026-44437](https://cve.now/CVE-2026-44437.md): Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix (CVSS 6.9) - [CVE-2026-41423](https://cve.now/CVE-2026-41423.md): Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server (CVSS 8.7) - [CVE-2026-33397](https://cve.now/CVE-2026-33397.md): Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass (CVSS 6.9) - [CVE-2026-32635](https://cve.now/CVE-2026-32635.md): Angular has XSS in i18n attribute bindings (CVSS 8.6) - [CVE-2026-27970](https://cve.now/CVE-2026-27970.md): Angular i18n vulnerable to Cross-Site Scripting (XSS) (CVSS 7.6) - [CVE-2026-27739](https://cve.now/CVE-2026-27739.md): Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline (CVSS 9.2) - [CVE-2026-27738](https://cve.now/CVE-2026-27738.md): Angular SSR has an Open Redirect via X-Forwarded-Prefix (CVSS 6.9) - [CVE-2026-22610](https://cve.now/CVE-2026-22610.md): Angular has XSS Vulnerability via Unsanitized SVG Script Attributes (CVSS 8.5) - [CVE-2025-66412](https://cve.now/CVE-2025-66412.md): Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes (CVSS 8.5) - [CVE-2025-66035](https://cve.now/CVE-2025-66035.md): Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs (CVSS 7.7) - [CVE-2025-62427](https://cve.now/CVE-2025-62427.md): Server-Side Request Forgery (SSRF) in Angular SSR (CVSS 8.7) - [CVE-2025-59052](https://cve.now/CVE-2025-59052.md): Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage (CVSS 7.1) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/angular Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.