CVE Tools
Track your stack

Angular

22 CVEs tracked since 2026. Since Jun 2026, none of them reached CISA KEV.

Angular CVEs per month

Jun 2026 to Sep 2026. Point at a month, or focus the strip and use the arrow keys.
Angular CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-06170
2026-07null or fewer
2026-08null or fewer
2026-0950

Products

The products that kept showing up in Angular's monthly top three, with their CVEs summed over those months.

  1. Angular222 months
  2. Angular Language Service21 month
  3. Angular.ng-template11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Angular.

  1. CVE-2026-88060Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements—
  2. CVE-2026-88059Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`4.0
  3. CVE-2026-88058Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements—
  4. CVE-2026-88057Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler—
  5. CVE-2026-88056Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR—
  6. CVE-2026-69151Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes6.1
  7. CVE-2026-69149Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)6.1
  8. CVE-2026-68945Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning6.1
  9. CVE-2026-50171Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)6.1
  10. CVE-2026-50184Angular: Request Credential & Cache Policy Stripping in Angular Service Worker6.1
  11. CVE-2026-50169Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities6.1
  12. CVE-2026-46417Angular: SSRF via Hostname Hijacking in @angular/platform-server6.1
  13. CVE-2026-50168Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass8.2
  14. CVE-2026-50170Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache7.5
  15. CVE-2026-50556Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR6.1

The record

Peak rank
#52 in Jun 2026
Busiest month shown
Jun 2026, 17 CVEs
Months with a KEV entry
0 since Jun 2026
Monthly snapshots
2 since 2026
Angular's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store