ngrev

ngrev Graphical tool for reverse engineering of Angular projects. It allows you to navigate in the structure of your application and observe the relationship between the different modules, providers, and directives. The tool performs static code analysis which means that you don't have to run you...

Angular-Base64-Upload - Remote Code Execution

angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of...

CVE-2026-106144

Prototype Pollution in the Scheduler component @progress/kendo-angular-scheduler and @progress/kendo-angular-common in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype ...

CVE-2026-106141

Cross-Site Scripting XSS in the Editor component @progress/kendo-angular-editor in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link or image with an...

CVE-2026-106135

Cross-Site Scripting XSS in the Chat component @progress/kendo-angular-conversational-ui in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in ...

CVE-2026-106144 Prototype Pollution in Progress Software Kendo UI for Angular

Prototype Pollution in the Scheduler component @progress/kendo-angular-scheduler and @progress/kendo-angular-common in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype ...

CVE-2026-106144

Progress Software Kendo UI for Angular versions prior to 25.1.0 are vulnerable to a Prototype Pollution flaw in the Scheduler component. The vulnerability affects the @progress/kendo-angular-scheduler and @progress/kendo-angular-common packages. An attacker with high privileges who can control a ...

EUVD-2026-118368

Prototype Pollution in the Scheduler component @progress/kendo-angular-scheduler and @progress/kendo-angular-common in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype ...

EUVD-2026-118365

Cross-Site Scripting XSS in the Editor component @progress/kendo-angular-editor in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link or image with an...

CVE-2026-106141 Cross-Site Scripting in Progress Software Kendo UI for Angular

Cross-Site Scripting XSS in the Editor component @progress/kendo-angular-editor in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link or image with an...

CVE-2026-106141

Progress Software Kendo UI for Angular versions prior to 25.3.0 are vulnerable to a Cross-Site Scripting (XSS) flaw in the Editor component (@progress/kendo-angular-editor). A low-privileged attacker who can provide Editor content can inject a link or image with an unsafe URL . If a user interact...

CVE-2026-106135 Cross-Site Scripting in Progress Software Kendo UI for Angular

Cross-Site Scripting XSS in the Chat component @progress/kendo-angular-conversational-ui in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in ...

EUVD-2026-118361

Cross-Site Scripting XSS in the Chat component @progress/kendo-angular-conversational-ui in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in ...

CVE-2026-106135

Progress Software Kendo UI for Angular versions prior to 25.3.0 are vulnerable to Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui). A low-privileged attacker who can supply Chat messages can execute arbitrary JavaScript in another user's browser. The at...

CVE-2026-123322

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader...

EUVD-2026-118086

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader...

CVE-2026-123322

In JetBrains WebStorm versions prior to 2026.3 and 2026.2.4 , a vulnerability exists that allows for code execution within untrusted projects. The root cause is linked to the Angular CLI schematics loader (associated with CWE-829: Inclusion of Functionality from Untrusted Control Sphere ). The im...

CVE-2026-123322

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader...

CVE-2026-111753

A flaw was found in @angular/common. Due to discrepancies between internal URL validation and browser URL parsing standards, outgoing requests to external destinations can be misclassified as same-origin requests. A remote attacker who induces an application to send a request to an...

CVE-2026-111754

A flaw was found in @angular/platform-server. This vulnerability allows an unauthenticated remote attacker to trigger an open redirect, sending users to an attacker-controlled external domain. When server-side rendering SSR is enabled, validation checks for protocol-relative links occur before...