Skip to content
OpenAdvisories

Vendor

angular

45 known vulnerabilities.

Products

angular 38 angular-cli 6 compiler 2 core 2 platform-server 2 router 1 common 1 Angular.ng-template 1 @nguniversal/common 1 @nguniversal/express-engine 1 DevTools 1
All Critical High Medium Low Exploited only Public exploit

45 results · Feed

  • High 8.5
    CVE-2026-22610 Public exploit

    Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in …

    angular angular angular.js @angular/core Ubuntu npm
  • High 8.5
    CVE-2025-66412

    Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Tem…

    angular angular angular.js @angular/compiler Ubuntu npm
  • High 7.7
    CVE-2025-66035

    Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP client…

    angular angular angular.js @angular/common Ubuntu npm
  • High 8.7
    CVE-2025-62427

    Server-Side Request Forgery (SSRF) in Angular SSR

    The Angular SSR is a server-rise rendering tool for Angular applications. The vulnerability is a Server-Side Request Forgery (SSRF) flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (@angular/ssr) before 19.2.18, 20.3.6, and …

    angular angular-cli @angular/ssr npm
  • High 7.1
    CVE-2025-59052

    Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historic…

    angular angular @angular/platform-server @angular/ssr npm