Angular-Base64-Upload - Remote Code Execution

angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of...

ROOT-APP-NPM-CVE-2019-10768 CVE-2019-10768 in @rootio/angular - Patched by Root

Root has patched CVE-2019-10768 in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-21490 CVE-2024-21490 in @rootio/angular - Patched by Root

Root has patched CVE-2024-21490 in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2019-14863 CVE-2019-14863 in @rootio/angular - Patched by Root

Root has patched CVE-2019-14863 in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2020-7676 CVE-2020-7676 in @rootio/angular - Patched by Root

Root has patched CVE-2020-7676 in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-28HP-FGCR-2R4H GHSA-28hp-fgcr-2r4h in @rootio/angular - Patched by Root

Root has patched GHSA-28hp-fgcr-2r4h in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-5CP4-XMRW-59WF GHSA-5cp4-xmrw-59wf in @rootio/angular - Patched by Root

Root has patched GHSA-5cp4-xmrw-59wf in the @rootio/angular package for Root:npm. Multiple fixed versions available...

CVE-2026-54267

A flaw was found in the Angular framework's client-side hydration feature for Server-Side Rendered SSR applications. This vulnerability, known as DOM Clobbering, allows a remote attacker to inject malicious data into the application's internal data cache. By exploiting a predictable identifier us...

CVE-2026-52725

A flaw was found in the @angular/core component. This vulnerability allows an attacker to bypass security restrictions when creating dynamic components. By manipulating the host element or selector, an attacker can force an Angular component to be mounted directly onto a script tag. This can resu...

ROOT-APP-NPM-CVE-2024-8372 CVE-2024-8372 in @rootio/angular - Patched by Root

Root has patched CVE-2024-8372 in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-0716 CVE-2025-0716 in @rootio/angular - Patched by Root

Root has patched CVE-2025-0716 in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-8373 CVE-2024-8373 in @rootio/angular - Patched by Root

Root has patched CVE-2024-8373 in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2023-26117 CVE-2023-26117 in @rootio/angular - Patched by Root

Root has patched CVE-2023-26117 in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2023-26118 CVE-2023-26118 in @rootio/angular - Patched by Root

Root has patched CVE-2023-26118 in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2023-26116 CVE-2023-26116 in @rootio/angular - Patched by Root

Root has patched CVE-2023-26116 in the @rootio/angular package for Root:npm. Multiple fixed versions available...

CVE-2026-54268

A flaw was found in the @angular/common package of the Angular framework. A remote attacker could exploit a Denial of Service DoS vulnerability in the formatDate function, which is also used by the Angular DatePipe, by providing an excessively long and maliciously crafted date format string. This...

CVE-2026-50557

A flaw was found in Angular's @angular/compiler and @angular/core packages. Namespaced script elements were not properly identified by the template preparser, and security context schema mappings did not consistently handle attributes within namespaced elements. An attacker who can inject templat...

CVE-2026-54265

A flaw was found in Angular's @angular/compiler package. When a native DOM property requiring sanitization is bound using two-way binding syntax, the template compiler fails to apply the appropriate sanitizer. An attacker who controls the bound value can bypass Angular's built-in sanitization,...

angular: Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

A flaw exists in the template compiler of Angular as it fails to properly classify certain URL-bearing attributes including SVG and MathML attributes such as href, xlink:href, or the attributeName of SVG animation elements as requiring strict sanitization. As a result, an attacker who can supply...

CVE-2026-46417

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.12, 21.2.13, 20.3.21, and 19.2.22, a Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server. The issue stems from how...