angular

Every one of the 39 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)CVE-2026-111752angular · CVSS 8.2 · 1.0% likely

   CWE-405

2. Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)CVE-2026-111754angular · CVSS 5.1 · 1.0% likely

   CWE-601

3. Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)CVE-2026-101896angular · CVSS 8.2 · 0.9% likely

   CWE-770

4. Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPECVE-2026-101895angular · CVSS 8.7 · 0.9% likely

   CWE-400

5. Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLsCVE-2025-66035angular · CVSS 7.7 · 0.7% likely

   CWE-201

6. Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)CVE-2026-111751angular · CVSS 8.2 · 0.7% likely

   CWE-770

7. Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)CVE-2026-54268angular · CVSS 8.2 · 0.6% likely

   CWE-1333

8. Angular i18n vulnerable to Cross-Site Scripting (XSS)CVE-2026-27970angular · CVSS 7.1 · 0.5% likely

   CWE-79

9. Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSRCVE-2026-88056angular · CVSS 8.6 · 0.5% likely

   CWE-918

10. Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)CVE-2026-111753angular · CVSS 5.9 · 0.5% likely

    CWE-201

11. Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service ExtensionCVE-2026-50178angular · CVSS 8.7 · 0.5% likely

    CWE-79

12. Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)CVE-2026-52725angular · CVSS 5.3 · 0.5% likely

    CWE-79

13. Angular has XSS Vulnerability via Unsanitized SVG Script AttributesCVE-2026-22610angular · CVSS 8.5 · 0.4% likelycovered by CyberSIXT

    CWE-79

14. Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCacheCVE-2026-50170angular · CVSS 8.2 · 0.4% likely

    CWE-524

15. Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)CVE-2026-69149angular · CVSS 8.6 · 0.4% likely

    CWE-79

16. Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSRCVE-2026-50556angular · CVSS 8.1 · 0.4% likely

    CWE-79

17. Angular: Template and Attribute Namespace Sanitization Bypass (XSS)CVE-2026-50557angular · CVSS 5.3 · 0.4% likely

    CWE-79

18. Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service WorkerCVE-2026-54264angular · CVSS 8.3 · 0.4% likely

    CWE-359

19. Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML AttributesCVE-2025-66412angular · CVSS 8.5 · 0.4% likely

    CWE-79

20. Angular Client Hydration DOM Clobbering & Response-Cache PoisoningCVE-2026-54267angular · CVSS 8.6 · 0.4% likely

    CWE-79

21. Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilerCVE-2026-88057angular · CVSS 5.3 · 0.4% likely

    CWE-79

22. Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data LeakageCVE-2025-59052angular · CVSS 7.1 · 0.4% likely

    CWE-362

23. Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content ElementsCVE-2026-88060angular · CVSS 8.6 · 0.4% likely

    CWE-79

24. Angular: SSRF via Hostname Hijacking in @angular/platform-serverCVE-2026-46417angular · CVSS 8.8 · 0.4% likely

    CWE-918

25. Angular DevTools (Local DoS)CVE-2026-101897angular · CVSS 5.1 · 0.4% likely

    CWE-441

26. Angular: Two-Way Property Binding Sanitization Bypass (XSS)CVE-2026-54265angular · CVSS 5.3 · 0.3% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.