@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8), @manniwatch/client-desktop (>=0.30.0, <=0.30.1) +3 more potentially affected by CVE-2026-27738 +1 more via @angular/ssr (>=19.0.5, <=19.2.19)

@angular/ssr NPM version =19.0.5, =1.0.5, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =19.0.0-alpha.24 Source cves: CVE-2026-27738, CVE-2026-33397 Source advisory: OSV:GHSA-XH43-G2FQ-WJRJ...

@nestjs/ng-universal (>=7.1.0, <=7.1.1), @nguniversal/builders (>=16.0.0-next.0, <=16.1.3) +1 more potentially affected by CVE-2025-59052 via @nguniversal/common (>=16.0.0, <=16.1.3)

@nguniversal/common NPM version =16.0.0, =7.1.0, =16.0.0-next.0, =16.0.0-next.0, =16.1.3 Source cves: CVE-2025-59052 Source advisory: OSV:GHSA-68X2-MX4Q-78M7...

Race Condition

Overview @nguniversal/common is an Angular Universal module that is common across server-side rendering app irrespective of the rendering engine Affected versions of this package are vulnerable to Race Condition between multiple concurrent requests in the global platform injector, when using the...

PT-2023-33057

Name of the Vulnerable Software and Affected Versions Angular Universal versions 16.1.0 through 16.1.1 Description The issue allows an attacker to trick another user into visiting a page that injects malicious JavaScript, resulting in a cross-site scripting XSS attack. This occurs when critical C...