Angular

Every one of the 40 is a mark on the map. Named now: 27 to 40, most at risk first.

27. Angular: Two-Way Property Binding Sanitization Bypass (XSS)CVE-2026-54265angular · CVSS 5.3 · 0.3% likely

    CWE-79

28. Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`CVE-2026-88059angular · CVSS 4 · 0.3% likely

    CWE-200

29. Angular i18n: Cross-Site Scripting (XSS) via event-handler attributesCVE-2026-69151angular · CVSS 7.6 · 0.3% likely

    CWE-79

30. Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-ServerCVE-2026-41423angular · CVSS 8.7 · 0.3% likely

    CWE-918

31. A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via inject…CVE-2025-61261Angular · CVSS 5.4 · 0.3% likely

    CWE-79

32. Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content ElementsCVE-2026-88058angular · CVSS 8.6 · 0.3% likely

    CWE-79

33. Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-serverCVE-2026-50555angular · CVSS 8.6 · 0.3% likely

    CWE-79

34. Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)CVE-2026-50171angular · CVSS 8.2 · 0.3% likely

    CWE-400

35. Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code ExtensionCVE-2026-49241angular · CVSS 8.7 · 0.2% likely

    CWE-79

36. Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist BypassCVE-2026-50168angular · CVSS 8.8 · 0.2% likely

    CWE-346

37. Angular Service Worker Policy-Bypass & Credential-Stripping VulnerabilitiesCVE-2026-50169angular · CVSS 5.7 · 0.2% likely

    CWE-200

38. Angular: Request Credential & Cache Policy Stripping in Angular Service WorkerCVE-2026-50184angular · CVSS 5.7 · 0.2% likely

    CWE-200

39. Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State PoisoningCVE-2026-68945angular · CVSS 8.8 · 0.2% likely

    CWE-345

40. Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State PoisoningCVE-2026-54266angular · CVSS 8.8 · 0.1% likely

    CWE-328

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.