@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-exui-4425, <=4.2.17) +1 more potentially affected by CVE-2026-41423 via @angular/platform-server (>=20.0.0, <=20.3.18)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-exui-4425, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-41423 Source advisory: OSV:GHSA-45Q2-GJVG-7973...

Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

Impact A Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering SSR. When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine Express, etc. passes the URL string to Angular’s...

Server-side Request Forgery (SSRF)

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the URL parsing during Server-Side Rendering SSR. An attacker can cause the server to make arbitrary HTTP requests to...

GHSA-45Q2-GJVG-7973 Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

Impact A Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering SSR. When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine Express, etc. passes the URL string to Angular’s...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-41423 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-41423 Source advisory:...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4), @irshadali/ngx-indexed-db (>=19.3.0, <=19.3.1) +16 more potentially affected by CVE-2026-41423 via @angular/platform-server (>=18.2.13, <=18.2.14)

@angular/platform-server NPM version =18.2.13, =1.0.0, =19.3.0, =0.0.0, =12.0.0, =0.0.0, =1.0.2, =0.0.0, =1.0.0, =0.0.1, =0.0.2 - my-unique-workspace 0.0.0 - my-workspace01 0.0.0 and more Source cves: CVE-2026-41423 Source advisory: OSV:GHSA-45Q2-GJVG-7973...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-41423 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-41423 Source advisory: OSV:GHSA-45Q2-GJVG-7973...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-41423 via @angular/platform-server (>=21.1.2, <=21.2.0)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-41423 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-16097942...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-exui-4425, <=4.2.17) +1 more potentially affected by CVE-2026-41423 via @angular/platform-server (>=20.0.0, <=20.3.18)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-exui-4425, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-41423 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-16097942...

PT-2026-35292

Impact A Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering SSR. When an attacker sends a request such as GET /evil.com/ HTTP/1.1 the server engine Express, etc. passes the URL string to Angular’s renderi...

PT-2026-37114

Name of the Vulnerable Software and Affected Versions Angular versions prior to 19.2.21 Angular versions prior to 20.3.19 Angular versions prior to 21.2.9 Angular versions prior to 22.0.0-next.8 Description A Server-Side Request Forgery SSRF issue exists in @angular/platform-server due to imprope...

Exploit for CVE-2025-69993

Leaflet XSS POC Proof of Concept for CVE-2025-69993 — XSS vul...

Exploit for CVE-2026-27739

-CVE-2026-27739-poc curl -H "X-Forwarded-For: http://169.254...

Security Bulletin: Multiple vulnerabilities found in IBM ApplinX.

Summary IBM ApplinX has been updated in order to address multiple vulnerabilities CVE-2026-27970, CVE-2026-29063, CVE-2025-68161, CVE-2026-27830, CVE-2024-31033, CVE-2026-33671, CVE-2026-33672, CVE-2026-32635, CVE-2025-66035, CVE-2025-66412, CVE-2026-22610, WS-2026-0003. Vulnerability Details...

CVE-2026-33397

The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-next.2, the 21.x branch prior to 21.2.3, and the 20.x branch prior to 20.3.21 have an Open Redirect vulnerability in @angular/ssr due to an incomplete fix for CVE-2026-27738. Whil...

CVE-2026-33397

The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-next.2, the 21.x branch prior to 21.2.3, and the 20.x branch prior to 20.3.21 have an Open Redirect vulnerability in @angular/ssr due to an incomplete fix for CVE-2026-27738. Whil...

CVE-2026-33397 Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass

The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-next.2, the 21.x branch prior to 21.2.3, and the 20.x branch prior to 20.3.21 have an Open Redirect vulnerability in @angular/ssr due to an incomplete fix for CVE-2026-27738. Whil...

CVE-2026-33397 Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass

The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-next.2, the 21.x branch prior to 21.2.3, and the 20.x branch prior to 20.3.21 have an Open Redirect vulnerability in @angular/ssr due to an incomplete fix for CVE-2026-27738. Whil...

CVE-2026-33397

The CVE concerns Angular SSR bottleneck/open-redirect in @angular/ssr. Affected series: 22.x before 22.0.0-next.2, 21.x before 21.2.3, and 20.x before 20.3.21, with a patch included in 22.0.0-next.2, 21.2.3, and 20.3.21. Root cause: incomplete fix for CVE-2026-27738 where a single backslash in X-...

CVE-2026-33397

The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-next.2, the 21.x branch prior to 21.2.3, and the 20.x branch prior to 20.3.21 have an Open Redirect vulnerability in @angular/ssr due to an incomplete fix for CVE-2026-27738. Whil...