EUVD-2026-52407

Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...

CVE-2026-69151

A flaw was found in the Angular compiler's internationalization i18n pipeline. This vulnerability allows a lower-trust translation file to replace a static event handler with executable JavaScript. A remote attacker could exploit this by injecting malicious scripts, leading to Cross-Site Scriptin...

Cross-site Scripting (XSS)

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Cross-site Scripting XSS in the bundled domino DOM serializer, which does not escape text nodes inside the fallback raw-content elements , , , and during SSR...

CVE-2026-69149

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-18243

Certain HP DesignJet products may be potentially vulnerable to cross-site scripting XSS, which may allow unauthenticated HTTP requests to view print job previews...

UBUNTU-CVE-2026-69149

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

Important: Red Hat Security Advisory: Kiali 2.27.2 for Red Hat OpenShift Service Mesh 3.4

Kiali 2.27.2 for Red Hat OpenShift Service Mesh 3.4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the compiler's i18n metadata collection path, which lets event-handler attributes be marked translatable with i18n-on such as i18n-onerror, bypassing the validation that normally blocks binding to event-handl...

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

A Cross-Site Scripting XSS vulnerability has been identified in the Angular compiler's internationalization i18n pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation validateAttribute / validateProperty, the i18...

CVE-2026-69151 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

CVE-2026-69151 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

CVE-2026-69151 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

EUVD-2026-52369

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

GHSA-VPX6-8PJR-4G3V Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

A Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing the content of fallback raw-content elements , , , and . When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engi...

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

A Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing the content of fallback raw-content elements , , , and . When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engi...

CVE-2026-69149 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-69149

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-69149 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

EUVD-2026-52350

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-67612 OpenEMR 8.2.0 Stored XSS via import_template.php Template Management

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags...