A
Vendor security profile
angular
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs25
Critical0
CISA KEV0
Public exploit5
Patch rate%92
Avg. CVSS6.8
12-month vulnerability rate
0
0
0
1
0
0
0
15
0
3
5
1
CVE KEV
CVE severity distribution
25toplam CVE
High9 (36%)
Medium16 (64%)
Patch and exploitation view
%92
Verified patch
%0
CISA KEV
%20
Public exploit
22Patch available
1Partial
0Workaround
0Vendor: no patch
2Unknown
Latest vulnerabilities
6.3
CVE-2026-104871
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
A
Patch status unknownEPSS %0
8.6
CVE-2026-88060
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
A
Patch verifiedEPSS %0
4.0
CVE-2026-88059
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
A
Patch verifiedEPSS %0
8.6
CVE-2026-88058
Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
A
Patch verifiedEPSS %0
5.3
CVE-2026-88057
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
A
Patch verifiedEPSS %0
8.6
CVE-2026-88056
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
A
Patch verifiedEPSS %1
7.6
CVE-2026-69151
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
A
Partial patchEPSS %0
8.6
CVE-2026-69149
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
A
Patch verifiedEPSS %0
8.8
CVE-2026-68945
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
A
Patch verifiedEPSS %0
6.1
CVE-2026-50556
Cross-site scripting in Angular
A
Patch verifiedEPSS %0