1047877 matches found
CVE-2026-66296
The CVE-2026-66296 issue concerns oaskit: a reflected XSS vulnerability in the default HTML error handler. The root cause is that Oaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 render request-validation failures as HTML when the Accept header includes...
@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-69149 via @angular/platform-server (>=20.0.0, <=20.3.19)
@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-69149 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-18550630...
@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +36 more potentially affected by CVE-2026-69151 via @angular/compiler (>=20.0.0, <=20.3.21)
@angular/compiler NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =0.0.57, =0.0.60 - @saritasa/renewaire-frontend-sdk 0.1.0-dev.101 and more Source cves: CVE-2026-69151 Source advisory:...
@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +21 more potentially affected by CVE-2026-69151 via @angular/compiler (>=21.0.0, <=21.2.17)
@angular/compiler NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =1.0.0, =4.4.0-beta.2, =1.0.0-next.27766, =1.0.77-rc.1, =0.0.1, =0.5.11 - foliokit 0.0.0 and more Source cves: CVE-2026-69151 Source advisory:...
@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +44 more potentially affected by CVE-2026-69151 via @angular/core (>=20.0.0, <=20.3.25)
@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...
CVE-2026-69151
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes is caused by the i18n pipeline allowing i18n-onerror and similar attributes to be translated, enabling a lower-trust translation file to replace a benign handler with executable JavaScript. Affected versions are prior to 20.3.2...
3d-card (0.0.2), @cosla/sensemaking-web-ui (>=1.0.5, <=1.0.9) +21 more potentially affected by CVE-2026-69149 via @angular/platform-server (>=19.2.18, <=19.2.25)
@angular/platform-server NPM version =19.2.18, =1.0.5, =0.0.1-rc.2, =1.0.0, =0.0.2, =19.1.0, =16.0.0, =1.52.0, =0.0.0, =0.0.0, =14.1.0, =14.3.0 and more Source cves: CVE-2026-69149 Source advisory: OSV:GHSA-VPX6-8PJR-4G3V...
CVE-2026-69149 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...
CVE-2026-69149
CVE-2026-69149 affects Angular SSR: a Cross-Site Scripting (XSS) vulnerability in the DOM emulation dependency (domino) used by @angular/platform-server when serializing fallback raw-content elements (, , , ). The issue exists prior to versions 20.3.27, 21.2.19, and 22.0.7 and is fixed in those r...
@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.209-alpha) +48 more potentially affected by CVE-2026-68945 via @angular/common (>=21.0.0, <=21.2.17)
@angular/common NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.2 and more Source cves: CVE-2026-68945 Source advisory: SNYK:JS-ANGULARCOMMON-18550632...
@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +33 more potentially affected by CVE-2026-68945 via @angular/common (>=20.0.0, <=20.3.25)
@angular/common NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.7.2, =0.7.3 and more Source cves: CVE-2026-68945 Source advisory: OSV:GHSA-JHPW-976M-542J...
@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.209-alpha) +48 more potentially affected by CVE-2026-68945 via @angular/common (>=21.0.0, <=21.2.17)
@angular/common NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.2 and more Source cves: CVE-2026-68945 Source advisory: OSV:GHSA-JHPW-976M-542J...
3d-card (0.0.2), 4byte-peru-components (1.0.0) +315 more potentially affected by CVE-2026-68945 via @angular/common (>=19.0.0, <=19.2.25)
@angular/common NPM version =19.0.0, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 - @astro-sports-developers/shared 0.0.3 and more Source cves: CVE-2026-68945 Source advisory: OSV:GHSA-JHPW-976M-542J...
CVE-2026-15931
The issue is CVE-2026-15931 affecting the Simple Membership WordPress plugin prior to version 4.7.8. The vulnerability arises because the plugin does not sanitize a subscriber name value sent via an unauthenticated payment approval request, and it also fails to escape this value when shown in the...
CVE-2026-15931 Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes...
CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
PT-2026-67466
A stored cross-site scripting XSS vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in multiple staff-facing templates without proper output encoding...
CVE-2026-68583 luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser...
