@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +50 more potentially affected by CVE-2026-50170 via @angular/common (>=21.0.0-next.1, <=21.2.14)

@angular/common NPM version =21.0.0-next.1, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-50170 Source advisory: GHSA-Q6F4-QQRG-JV6X...

Use of Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the HttpTransferCache utility. An attacker can access sensitive user-specific information by making requests to pages that have been cached by a shared caching layer after another user h...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +36 more potentially affected by CVE-2026-50170 via @angular/common (>=19.0.0-next.9, <=19.2.20)

@angular/common NPM version =19.0.0-next.9, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 - @ismailadekambi/shared 1.0.0 and more Source cves:...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +31 more potentially affected by CVE-2026-50170 via @angular/common (>=20.0.0-rc.0, <=20.3.21)

@angular/common NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.7.3 and more Source cves: CVE-2026-50170 Source advisory: SNYK:JS-ANGULARCOMMON-17356499...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +50 more potentially affected by CVE-2026-50170 via @angular/common (>=21.0.0-next.1, <=21.2.14)

@angular/common NPM version =21.0.0-next.1, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-50170 Source advisory: SNYK:JS-ANGULARCOMMON-17356499...

@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache

A vulnerability was discovered in @angular/common when Server-Side Rendering SSR and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via TransferState...

@agdo/object-model (>=1.0.1, <=1.2.34), @agilie/widget-template (>=1.0.2, <=1.1.6) +414 more potentially affected by CVE-2026-52725 via @angular/core (>=18.0.0-next.1, <=18.2.14)

@angular/core NPM version =18.0.0-next.1, =1.0.1, =1.0.2, =0.0.0, =1.0.0, =0.0.55, =1.0.0, =18.2.0, =7.0.0, =7.0.3 - @auscope/angular2parse 18.0.0 and more Source cves: CVE-2026-52725 Source advisory: OSV:GHSA-692R-GRFM-V8X7...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +38 more potentially affected by CVE-2026-52725 via @angular/core (>=19.0.0-next.9, <=19.2.20)

@angular/core NPM version =19.0.0-next.9, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 - @ismailadekambi/shared 1.0.0 and more Source cves:...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +38 more potentially affected by CVE-2026-52725 via @angular/core (>=19.0.0-next.9, <=19.2.20)

@angular/core NPM version =19.0.0-next.9, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 - @ismailadekambi/shared 1.0.0 and more Source cves:...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +41 more potentially affected by CVE-2026-52725 via @angular/core (>=20.0.0-rc.0, <=20.3.21)

@angular/core NPM version =20.0.0-rc.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +41 more potentially affected by CVE-2026-52725 via @angular/core (>=20.0.0-rc.0, <=20.3.21)

@angular/core NPM version =20.0.0-rc.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +54 more potentially affected by CVE-2026-52725 via @angular/core (>=21.0.0-next.1, <=21.2.14)

@angular/core NPM version =21.0.0-next.1, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =3.0.0 - @koalarx/ui 21.2.4 and more Source cves: CVE-2026-52725 Source advisory: SNYK:JS-ANGULARCORE-17353893...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +54 more potentially affected by CVE-2026-52725 via @angular/core (>=21.0.0-next.1, <=21.2.14)

@angular/core NPM version =21.0.0-next.1, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =3.0.0 - @koalarx/ui 21.2.4 and more Source cves: CVE-2026-52725 Source advisory: GHSA-692R-GRFM-V8X7...

GHSA-692R-GRFM-V8X7 @angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

An issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism createComponent failed to reject mounting components directly onto a or namespaced script element such as . This...

Cross-site Scripting (XSS)

Overview @angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this...

@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

An issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism createComponent failed to reject mounting components directly onto a or namespaced script element such as . This...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +41 more potentially affected by CVE-2026-52725 via @angular/core (>=20.0.0-rc.0, <=20.3.21)

@angular/core NPM version =20.0.0-rc.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +38 more potentially affected by CVE-2026-52725 via @angular/core (>=19.0.0-next.9, <=19.2.20)

@angular/core NPM version =19.0.0-next.9, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 - @ismailadekambi/shared 1.0.0 and more Source cves:...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +54 more potentially affected by CVE-2026-52725 via @angular/core (>=21.0.0-next.1, <=21.2.14)

@angular/core NPM version =21.0.0-next.1, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =3.0.0 - @koalarx/ui 21.2.4 and more Source cves: CVE-2026-52725 Source advisory: OSV:GHSA-692R-GRFM-V8X7...

@agdo/object-model (>=1.0.1, <=1.2.34), @agilie/widget-template (>=1.0.2, <=1.1.6) +414 more potentially affected by CVE-2026-52725 via @angular/core (>=18.0.0-next.1, <=18.2.14)

@angular/core NPM version =18.0.0-next.1, =1.0.1, =1.0.2, =0.0.0, =1.0.0, =0.0.55, =1.0.0, =18.2.0, =7.0.0, =7.0.3 - @auscope/angular2parse 18.0.0 and more Source cves: CVE-2026-52725 Source advisory: GHSA-692R-GRFM-V8X7...