Angular vulnerabilities
45 CVEs and advisories name Angular as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-52725Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
- CVE-2026-49241Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension
- CVE-2026-50557Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
- CVE-2026-44437Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
- CVE-2026-41423Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
- CVE-2026-33397Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass
- CVE-2026-32635Angular has XSS in i18n attribute bindings
- CVE-2026-27970Angular i18n vulnerable to Cross-Site Scripting (XSS)
- CVE-2026-27739Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
- CVE-2026-27738Angular SSR has an Open Redirect via X-Forwarded-Prefix
- CVE-2026-22610Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
- CVE-2025-66412Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
- CVE-2025-66035Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs
- CVE-2025-62427Server-Side Request Forgery (SSRF) in Angular SSR
- CVE-2025-59052Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage