Login Request a demo
AN
Product
angular
by angular · last CVE Oct 14, 2026
36
CVEs
0
On KEV
9.1
Max CVSS
3
New 30D
Vulnerabilities36In the news1Timeline
Severity mix
Critical 1High 9Medium 26Low 0
Severity
All severities36Critical1High9Medium26Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add angular to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-50178
8.8
1%
Jun 22
Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension
Affected: < 21.2.4
CVE-2026-49241
8.8
0%
Jun 22
Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension
Affected: < 21.2.4
CVE-2026-101895
8.7
1%
Oct 14
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
Affected: <= 19.2.25; >= 20.0.0, < 20.3.31; >= 21.0.0, < 21.2.23; >= 22.0.0, < 22.1.6
CVE-2026-101896
8.2
1%
Oct 14
Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)
Affected: <= 19.2.25; >= 20.0.0, < 20.3.32; >= 21.0.0, < 21.2.24; >= 22.0.0, < 22.2.0
CVE-2026-50168
8.2
0%
Jun 22
Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
Affected: >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.15; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14
CVE-2025-66035
7.7
1%
Nov 26
Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs
Affected: >= 21.0.0-next.0, < 21.0.1; >= 20.0.0-next.0, < 20.3.14; < 19.2.16
CVE-2026-50170
7.5
0%
Jun 22
Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
Affected: >= 22.0.0-next.0, < 22.0.0-rc.2; >= 21.0.0-next.0, < 21.2.15; >= 20.0.0-next.0, < 20.3.22; >= 19.0.0-next.0, < 19.2.23; <= 18.2.14
CVE-2026-54268
7.5
1%
Jun 22
Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
Affected: >= 22.0.0-next.0 < 22.0.1; >= 21.0.0-next.0 < 21.2.17; >= 20.0.0-next.0 < 20.3.25; <= 19.2.25
CVE-2025-59052
7.1
0%
Sep 10
Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage
Affected: @angular/platform-server >= 16.0.0-next.0, < 18.2.14; @angular/platform-server >= 20.0.0-next.0, < 20.3.0; @angular/platform-server >= 19.0.0-next.0, < 19.2.15; @angular/platform-server >= 21.0.0-next.0, < 21.0.0-next.3; @angular/ssr >= 17.0.0-next.0, < 18.2.21; @angular/ssr >= 19.0.0-next.0, < 19.2.16; +3 more
Showing 9