Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-101896 (GCVE-0-2026-101896)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:05 – Updated: 2026-10-14 15:05

Title

Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7616 records in the last 180 days details

References

9 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/issues/70716	x_refsource_MISC
https://github.com/angular/angular/pull/70717	x_refsource_MISC
https://github.com/angular/angular/commit/03872a8…	x_refsource_MISC
https://github.com/angular/angular/commit/5af6121…	x_refsource_MISC
https://github.com/angular/angular/commit/ddfe210…	x_refsource_MISC
https://github.com/angular/angular/releases/tag/v…	x_refsource_MISC
https://github.com/angular/angular/releases/tag/v…	x_refsource_MISC
https://github.com/angular/angular/releases/tag/v22.2.0	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
angular	angular	Affected: <= 19.2.25 Affected: >= 20.0.0, < 20.3.32 Affected: >= 21.0.0, < 21.2.24 Affected: >= 22.0.0, < 22.2.0
@angular	router	Affected: <= 19.2.25 Affected: >= 20.0.0, < 20.3.32 Affected: >= 21.0.0, < 21.2.24 Affected: >= 22.0.0, < 22.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 19.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0, \u003c 20.3.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 21.2.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0, \u003c 22.2.0"
            }
          ]
        },
        {
          "product": "router",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 19.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0, \u003c 20.3.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 21.2.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0, \u003c 22.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:05:42.934Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-ff3f-86qr-9cv3"
        },
        {
          "name": "https://github.com/angular/angular/issues/70716",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/issues/70716"
        },
        {
          "name": "https://github.com/angular/angular/pull/70717",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/70717"
        },
        {
          "name": "https://github.com/angular/angular/commit/03872a80bcf1c89b2b04cdd3f444b2ee954da583",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/03872a80bcf1c89b2b04cdd3f444b2ee954da583"
        },
        {
          "name": "https://github.com/angular/angular/commit/5af61216eab8bf4a6697a1d79bda3d857c06f89d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/5af61216eab8bf4a6697a1d79bda3d857c06f89d"
        },
        {
          "name": "https://github.com/angular/angular/commit/ddfe21072ba32ca4cd9d7d3c6b7df66af81d58c4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/ddfe21072ba32ca4cd9d7d3c6b7df66af81d58c4"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v20.3.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v20.3.32"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v21.2.24",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v21.2.24"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v22.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v22.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-ff3f-86qr-9cv3",
        "discovery": "UNKNOWN"
      },
      "title": "Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-101896",
    "datePublished": "2026-10-14T15:05:42.934Z",
    "dateReserved": "2026-09-28T15:55:37.906Z",
    "dateUpdated": "2026-10-14T15:05:42.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-69151 (GCVE-0-2026-69151)

Vulnerability from cvelistv5 – Published: 2026-08-03 16:23 – Updated: 2026-08-03 21:19

Title

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 21:17 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7616 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/pull/68821	x_refsource_MISC
https://github.com/angular/angular/pull/69306	x_refsource_MISC
https://github.com/angular/angular/commit/417a407…	x_refsource_MISC
https://github.com/angular/angular/commit/6c41f5c…	x_refsource_MISC

Impacted products

3 products

Vendor	Product	Version
angular	angular	Affected: >= 22.0.0-next.0, < 22.0.1 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27
@angular	compiler	Affected: >= 22.0.0-next.0, < 22.0.1 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27
@angular	core	Affected: >= 22.0.0-next.0, < 22.0.1 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69151",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T21:17:58.775539Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T21:19:24.394Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            }
          ]
        },
        {
          "product": "compiler",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T16:23:34.121Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99"
        },
        {
          "name": "https://github.com/angular/angular/pull/68821",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/68821"
        },
        {
          "name": "https://github.com/angular/angular/pull/69306",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/69306"
        },
        {
          "name": "https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e"
        },
        {
          "name": "https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865"
        }
      ],
      "source": {
        "advisory": "GHSA-jj27-h5hq-8x99",
        "discovery": "UNKNOWN"
      },
      "title": "Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69151",
    "datePublished": "2026-08-03T16:23:34.121Z",
    "dateReserved": "2026-08-03T15:47:09.654Z",
    "dateUpdated": "2026-08-03T21:19:24.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-69149 (GCVE-0-2026-69149)

Vulnerability from cvelistv5 – Published: 2026-08-03 16:14 – Updated: 2026-08-03 20:33

Title

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 20:33 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7616 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/pull/69675	x_refsource_MISC
https://github.com/angular/angular/pull/69714	x_refsource_MISC
https://github.com/angular/angular/pull/69929	x_refsource_MISC
https://github.com/angular/angular/pull/69930	x_refsource_MISC
https://github.com/angular/domino/pull/32	x_refsource_MISC
https://github.com/angular/domino/commit/f88e5aa4…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
angular	angular	Affected: < 20.3.27 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.7
@angular	platform-server	Affected: < 20.3.27 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69149",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T20:33:37.200757Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T20:33:46.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.7"
            }
          ]
        },
        {
          "product": "platform-server",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server\u0027s DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (\u003ciframe\u003e, \u003cnoembed\u003e, \u003cnoframes\u003e, and \u003cnoscript\u003e). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T16:14:39.636Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v"
        },
        {
          "name": "https://github.com/angular/angular/pull/69675",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/69675"
        },
        {
          "name": "https://github.com/angular/angular/pull/69714",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/69714"
        },
        {
          "name": "https://github.com/angular/angular/pull/69929",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/69929"
        },
        {
          "name": "https://github.com/angular/angular/pull/69930",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/69930"
        },
        {
          "name": "https://github.com/angular/domino/pull/32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/domino/pull/32"
        },
        {
          "name": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56"
        }
      ],
      "source": {
        "advisory": "GHSA-vpx6-8pjr-4g3v",
        "discovery": "UNKNOWN"
      },
      "title": "Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69149",
    "datePublished": "2026-08-03T16:14:39.636Z",
    "dateReserved": "2026-08-03T15:47:09.654Z",
    "dateUpdated": "2026-08-03T20:33:46.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68945 (GCVE-0-2026-68945)

Vulnerability from cvelistv5 – Published: 2026-08-03 15:58 – Updated: 2026-08-03 16:58

Title

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 16:58 UTC

CWE

CWE-345 - Insufficient Verification of Data Authenticity

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7616 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/pull/68571	x_refsource_MISC
https://github.com/angular/angular/commit/6867f77…	x_refsource_MISC
https://github.com/angular/angular/commit/948a8d6…	x_refsource_MISC
https://github.com/angular/angular/commit/a64e288…	x_refsource_MISC
https://github.com/angular/angular/commit/a6c7fc5…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
angular	angular	Affected: < 20.3.27 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.2
@angular	common	Affected: < 20.3.27 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68945",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T16:58:17.198889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T16:58:26.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
            }
          ]
        },
        {
          "product": "common",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T15:58:02.299Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j"
        },
        {
          "name": "https://github.com/angular/angular/pull/68571",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/68571"
        },
        {
          "name": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c"
        },
        {
          "name": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35"
        },
        {
          "name": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b"
        },
        {
          "name": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c"
        }
      ],
      "source": {
        "advisory": "GHSA-jhpw-976m-542j",
        "discovery": "UNKNOWN"
      },
      "title": "Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-68945",
    "datePublished": "2026-08-03T15:58:02.299Z",
    "dateReserved": "2026-07-31T21:49:24.928Z",
    "dateUpdated": "2026-08-03T16:58:26.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-32635 (GCVE-0-2026-32635)

Vulnerability from cvelistv5 – Published: 2026-03-13 20:58 – Updated: 2026-03-17 03:55

Title

Angular has XSS in i18n attribute bindings

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-16 00:00 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7616 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/pull/67541	x_refsource_MISC
https://github.com/angular/angular/pull/67561	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
@angular	compiler	Affected: >= 22.0.0-next.0, < 22.0.0-next.3 Affected: >= 21.0.0-next.0, < 21.2.4 Affected: >= 20.0.0-next.0, < 20.3.18 Affected: >= 17.0.0.next.0, < 19.2.20
@angular	core	Affected: >= 22.0.0-next.0, < 22.0.0-next.3 Affected: >= 21.0.0-next.0, < 21.2.4 Affected: >= 20.0.0-next.0, < 20.3.18 Affected: >= 17.0.0.next.0, < 19.2.20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-16T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-17T03:55:33.785Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compiler",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-next.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0-next.0, \u003c 20.3.18"
            },
            {
              "status": "affected",
              "version": "\u003e= 17.0.0.next.0, \u003c 19.2.20"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-next.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0-next.0, \u003c 20.3.18"
            },
            {
              "status": "affected",
              "version": "\u003e= 17.0.0.next.0, \u003c 19.2.20"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular\u0027s ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-\u003cattribute\u003e name bypasses Angular\u0027s built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T20:58:12.554Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222"
        },
        {
          "name": "https://github.com/angular/angular/pull/67541",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/67541"
        },
        {
          "name": "https://github.com/angular/angular/pull/67561",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/67561"
        }
      ],
      "source": {
        "advisory": "GHSA-g93w-mfhg-p222",
        "discovery": "UNKNOWN"
      },
      "title": "Angular has XSS in i18n attribute bindings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32635",
    "datePublished": "2026-03-13T20:58:12.554Z",
    "dateReserved": "2026-03-12T15:29:36.559Z",
    "dateUpdated": "2026-03-17T03:55:33.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-69151 (GCVE-0-2026-69151)

Vulnerability from nvd – Published: 2026-08-03 16:23 – Updated: 2026-08-03 21:19

Title

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 21:17 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7616 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/pull/68821	x_refsource_MISC
https://github.com/angular/angular/pull/69306	x_refsource_MISC
https://github.com/angular/angular/commit/417a407…	x_refsource_MISC
https://github.com/angular/angular/commit/6c41f5c…	x_refsource_MISC

Impacted products

3 products

Vendor	Product	Version
angular	angular	Affected: >= 22.0.0-next.0, < 22.0.1 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27
@angular	compiler	Affected: >= 22.0.0-next.0, < 22.0.1 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27
@angular	core	Affected: >= 22.0.0-next.0, < 22.0.1 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: < 20.3.27

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69151",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T21:17:58.775539Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T21:19:24.394Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            }
          ]
        },
        {
          "product": "compiler",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T16:23:34.121Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-jj27-h5hq-8x99"
        },
        {
          "name": "https://github.com/angular/angular/pull/68821",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/68821"
        },
        {
          "name": "https://github.com/angular/angular/pull/69306",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/69306"
        },
        {
          "name": "https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/417a4071a776464d549509ed3aec121dbd2fda5e"
        },
        {
          "name": "https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/6c41f5ca01c0ae045fc7d929b72853a11eb55865"
        }
      ],
      "source": {
        "advisory": "GHSA-jj27-h5hq-8x99",
        "discovery": "UNKNOWN"
      },
      "title": "Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69151",
    "datePublished": "2026-08-03T16:23:34.121Z",
    "dateReserved": "2026-08-03T15:47:09.654Z",
    "dateUpdated": "2026-08-03T21:19:24.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-69149 (GCVE-0-2026-69149)

Vulnerability from nvd – Published: 2026-08-03 16:14 – Updated: 2026-08-03 20:33

Title

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 20:33 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7616 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/pull/69675	x_refsource_MISC
https://github.com/angular/angular/pull/69714	x_refsource_MISC
https://github.com/angular/angular/pull/69929	x_refsource_MISC
https://github.com/angular/angular/pull/69930	x_refsource_MISC
https://github.com/angular/domino/pull/32	x_refsource_MISC
https://github.com/angular/domino/commit/f88e5aa4…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
angular	angular	Affected: < 20.3.27 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.7
@angular	platform-server	Affected: < 20.3.27 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69149",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T20:33:37.200757Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T20:33:46.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.7"
            }
          ]
        },
        {
          "product": "platform-server",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server\u0027s DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (\u003ciframe\u003e, \u003cnoembed\u003e, \u003cnoframes\u003e, and \u003cnoscript\u003e). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T16:14:39.636Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v"
        },
        {
          "name": "https://github.com/angular/angular/pull/69675",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/69675"
        },
        {
          "name": "https://github.com/angular/angular/pull/69714",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/69714"
        },
        {
          "name": "https://github.com/angular/angular/pull/69929",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/69929"
        },
        {
          "name": "https://github.com/angular/angular/pull/69930",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/69930"
        },
        {
          "name": "https://github.com/angular/domino/pull/32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/domino/pull/32"
        },
        {
          "name": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56"
        }
      ],
      "source": {
        "advisory": "GHSA-vpx6-8pjr-4g3v",
        "discovery": "UNKNOWN"
      },
      "title": "Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69149",
    "datePublished": "2026-08-03T16:14:39.636Z",
    "dateReserved": "2026-08-03T15:47:09.654Z",
    "dateUpdated": "2026-08-03T20:33:46.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68945 (GCVE-0-2026-68945)

Vulnerability from nvd – Published: 2026-08-03 15:58 – Updated: 2026-08-03 16:58

Title

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 16:58 UTC

CWE

CWE-345 - Insufficient Verification of Data Authenticity

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7616 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/pull/68571	x_refsource_MISC
https://github.com/angular/angular/commit/6867f77…	x_refsource_MISC
https://github.com/angular/angular/commit/948a8d6…	x_refsource_MISC
https://github.com/angular/angular/commit/a64e288…	x_refsource_MISC
https://github.com/angular/angular/commit/a6c7fc5…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
angular	angular	Affected: < 20.3.27 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.2
@angular	common	Affected: < 20.3.27 Affected: >= 21.0.0-next.0, < 21.2.19 Affected: >= 22.0.0-next.0, < 22.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68945",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T16:58:17.198889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T16:58:26.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
            }
          ]
        },
        {
          "product": "common",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.3.27"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T15:58:02.299Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j"
        },
        {
          "name": "https://github.com/angular/angular/pull/68571",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/68571"
        },
        {
          "name": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c"
        },
        {
          "name": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35"
        },
        {
          "name": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b"
        },
        {
          "name": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c"
        }
      ],
      "source": {
        "advisory": "GHSA-jhpw-976m-542j",
        "discovery": "UNKNOWN"
      },
      "title": "Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-68945",
    "datePublished": "2026-08-03T15:58:02.299Z",
    "dateReserved": "2026-07-31T21:49:24.928Z",
    "dateUpdated": "2026-08-03T16:58:26.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-32635 (GCVE-0-2026-32635)

Vulnerability from nvd – Published: 2026-03-13 20:58 – Updated: 2026-03-17 03:55

Title

Angular has XSS in i18n attribute bindings

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-<attribute> name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-16 00:00 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7616 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/pull/67541	x_refsource_MISC
https://github.com/angular/angular/pull/67561	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
@angular	compiler	Affected: >= 22.0.0-next.0, < 22.0.0-next.3 Affected: >= 21.0.0-next.0, < 21.2.4 Affected: >= 20.0.0-next.0, < 20.3.18 Affected: >= 17.0.0.next.0, < 19.2.20
@angular	core	Affected: >= 22.0.0-next.0, < 22.0.0-next.3 Affected: >= 21.0.0-next.0, < 21.2.4 Affected: >= 20.0.0-next.0, < 20.3.18 Affected: >= 17.0.0.next.0, < 19.2.20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-16T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-17T03:55:33.785Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compiler",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-next.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0-next.0, \u003c 20.3.18"
            },
            {
              "status": "affected",
              "version": "\u003e= 17.0.0.next.0, \u003c 19.2.20"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "@angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-next.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0, \u003c 21.2.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0-next.0, \u003c 20.3.18"
            },
            {
              "status": "affected",
              "version": "\u003e= 17.0.0.next.0, \u003c 19.2.20"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular\u0027s ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n-\u003cattribute\u003e name bypasses Angular\u0027s built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T20:58:12.554Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-g93w-mfhg-p222"
        },
        {
          "name": "https://github.com/angular/angular/pull/67541",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/67541"
        },
        {
          "name": "https://github.com/angular/angular/pull/67561",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/67561"
        }
      ],
      "source": {
        "advisory": "GHSA-g93w-mfhg-p222",
        "discovery": "UNKNOWN"
      },
      "title": "Angular has XSS in i18n attribute bindings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32635",
    "datePublished": "2026-03-13T20:58:12.554Z",
    "dateReserved": "2026-03-12T15:29:36.559Z",
    "dateUpdated": "2026-03-17T03:55:33.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

9 vulnerabilities by @angular

CVE-2026-101896 (GCVE-0-2026-101896)

CVE-2026-69151 (GCVE-0-2026-69151)

CVE-2026-69149 (GCVE-0-2026-69149)

CVE-2026-68945 (GCVE-0-2026-68945)

CVE-2026-32635 (GCVE-0-2026-32635)

CVE-2026-69151 (GCVE-0-2026-69151)

CVE-2026-69149 (GCVE-0-2026-69149)

CVE-2026-68945 (GCVE-0-2026-68945)

CVE-2026-32635 (GCVE-0-2026-32635)