PT-2026-74895

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 15.2.9-tuxcare.1...

PT-2026-74384

TuxCare rebuilt angular-sanitize to address 2 CVEs. Fixed in 1.6.10-tuxcare.1...

PT-2026-74905

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 12.2.16-tuxcare.1...

PT-2026-74916

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 14.2.12-tuxcare.1...

PT-2026-75841

TuxCare rebuilt angular to address 4 CVEs. Fixed in 1.5.10-tuxcare.3...

PT-2026-74324

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 14.3.0-tuxcare.5...

PT-2026-74937

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 15.0.3-tuxcare.1...

PT-2026-74465

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 16.2.12-tuxcare.8...

PT-2026-74050

TuxCare rebuilt angular to address 3 CVEs. Fixed in 1.6.10-tuxcare.2...

PT-2026-74047

TuxCare rebuilt angular to address 3 CVEs. Fixed in 1.8.3-tuxcare.2...

CVE-2026-69151

A flaw was found in the Angular compiler's internationalization i18n pipeline. This vulnerability allows a lower-trust translation file to replace a static event handler with executable JavaScript. A remote attacker could exploit this by injecting malicious scripts, leading to Cross-Site Scriptin...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-69149 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-69149 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-18550630...

Cross-site Scripting (XSS)

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Cross-site Scripting XSS in the bundled domino DOM serializer, which does not escape text nodes inside the fallback raw-content elements , , , and during SSR...

CVE-2026-68945

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

CVE-2026-69151

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

CVE-2026-69149

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-68945

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

CVE-2026-69151

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

UBUNTU-CVE-2026-68945

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

UBUNTU-CVE-2026-69151

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...