Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Cross-Site Scripting.

Summary compiler-18.2.14.tgz is used by IBM Sterling Connect:Direct Web Services CVE-2026-32635. Vulnerability Details CVEID:CVE-2026-32635 DESCRIPTION: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to...

@bnsights-test/test-admin-portal (>=0.0.18, <=0.0.60), @bnsights-test/test-controls (>=0.0.15, <=0.0.55) +13 more potentially affected by CVE-2026-54264 via @angular/service-worker (>=19.0.0, <=19.2.25)

@angular/service-worker NPM version =19.0.0, =0.0.18, =0.0.15, =1.0.0, =1.0.110, =1.2.3, =19.0.0-next.1, =19.0.0-next.1, =0.30.0, =0.30.0, =0.0.1, =16.0.0, =1.52.0, =19.0.0, =0.0.27, =0.0.122 Source cves: CVE-2026-54264 Source advisory: OSV:GHSA-QXH6-94W6-9R5P...

@eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32), @eui/deps-base-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) potentially affected by CVE-2026-54264 via @angular/service-worker (>=20.0.0, <=20.3.17)

@angular/service-worker NPM version =20.0.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 Source cves: CVE-2026-54264 Source advisory: OSV:GHSA-QXH6-94W6-9R5P...

@eui/deps-base (>=21.0.0-alpha.10, <=23.0.0-alpha.1), @eui/deps-base-light (>=21.0.0-alpha.10, <=23.0.0-alpha.1) potentially affected by CVE-2026-54264 via @angular/service-worker (>=21.0.0, <=21.2.16)

@angular/service-worker NPM version =21.0.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =23.0.0-alpha.1 Source cves: CVE-2026-54264 Source advisory: SNYK:JS-ANGULARSERVICEWORKER-17359090...

GHSA-QXH6-94W6-9R5P @angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

An information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata such as headers from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive...

Exposure of Private Personal Information to an Unauthorized Actor

Overview @angular/service-worker is an Angular - service worker tooling! Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the newHeaders function. An attacker can obtain sensitive credentials and session identifiers by...

@eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32), @eui/deps-base-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) potentially affected by CVE-2026-54264 via @angular/service-worker (>=20.0.0, <=20.3.17)

@angular/service-worker NPM version =20.0.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 Source cves: CVE-2026-54264 Source advisory: SNYK:JS-ANGULARSERVICEWORKER-17359090...

@eui/deps-base (>=21.0.0-alpha.10, <=23.0.0-alpha.1), @eui/deps-base-light (>=21.0.0-alpha.10, <=23.0.0-alpha.1) potentially affected by CVE-2026-54264 via @angular/service-worker (>=21.0.0, <=21.2.16)

@angular/service-worker NPM version =21.0.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =23.0.0-alpha.1 Source cves: CVE-2026-54264 Source advisory: OSV:GHSA-QXH6-94W6-9R5P...

@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

An information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata such as headers from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +53 more potentially affected by CVE-2026-54268 via @angular/common (>=21.0.0, <=21.2.16)

@angular/common NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.4 and more Source cves: CVE-2026-54268 Source advisory: SNYK:JS-ANGULARCOMMON-17356486...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +53 more potentially affected by CVE-2026-54268 via @angular/common (>=21.0.0, <=21.2.16)

@angular/common NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.4 and more Source cves: CVE-2026-54268 Source advisory: OSV:GHSA-48R7-HPM6-GFXM...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +33 more potentially affected by CVE-2026-54268 via @angular/common (>=20.0.0, <=20.3.21)

@angular/common NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.7.3 and more Source cves: CVE-2026-54268 Source advisory: SNYK:JS-ANGULARCOMMON-17356486...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +33 more potentially affected by CVE-2026-54268 via @angular/common (>=20.0.0, <=20.3.21)

@angular/common NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.7.3 and more Source cves: CVE-2026-54268 Source advisory: OSV:GHSA-48R7-HPM6-GFXM...

ngx-mat-input-tel (22.0.0) potentially affected by CVE-2026-54268 via @angular/common (22.0.0)

@angular/common NPM version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/common and may be impacted: - ngx-mat-input-tel 22.0.0 Source cves: CVE-2026-54268 Source advisory: OSV:GHSA-48R7-HPM6-GFXM...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +312 more potentially affected by CVE-2026-54268 via @angular/common (>=19.0.0, <=19.2.25)

@angular/common NPM version =19.0.0, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 - @astro-sports-developers/shared 0.0.3 and more Source cves: CVE-2026-54268 Source advisory: OSV:GHSA-48R7-HPM6-GFXM...

ngx-mat-input-tel (22.0.0) potentially affected by CVE-2026-54268 via @angular/common (22.0.0)

@angular/common NPM version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/common and may be impacted: - ngx-mat-input-tel 22.0.0 Source cves: CVE-2026-54268 Source advisory: SNYK:JS-ANGULARCOMMON-17356486...

@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

A Denial of Service DoS vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted,...

GHSA-48R7-HPM6-GFXM @angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

A Denial of Service DoS vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted,...

Use of Weak Hash

Overview Affected versions of this package are vulnerable to Use of Weak Hash due to the use of a weak 32-bit hash in the HttpTransferCache. When a victim visits a crafted link containing the colliding parameter, the SSR process executes both the search request and the profile request. Due to the...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +33 more potentially affected by CVE-2026-54266 via @angular/common (>=20.0.0, <=20.3.21)

@angular/common NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.7.3 and more Source cves: CVE-2026-54266 Source advisory: SNYK:JS-ANGULARCOMMON-17356555...