1639 matches found
CVE-2026-44643
Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that escapes the sandbox to execute arbitrary code on the system. This vulnerability is fixed in 1.5.2...
Security Bulletin: Due to use of core-18.2.14.tgz, IBM Sterling Connect:Direct Web Services is affected by cross-site scripting (XSS) issue.
Summary core-18.2.14.tgz is used by IBM Sterling Connect:Direct Web Services CVE-2026-22610, CVE-2026-27970. Vulnerability Details CVEID:CVE-2026-22610 DESCRIPTION: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages...
Malicious code in @aonunited/angular (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63dac830216ae445ebe7c5f45534e479d73a23a098ea9fc5740eeded5ebab4c9 On npm install, the package's preinstall script preinstall.js collects the installer's hostname, OS username, current working directory, and a...
MAL-2026-5150 Malicious code in @aonunited/angular (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63dac830216ae445ebe7c5f45534e479d73a23a098ea9fc5740eeded5ebab4c9 On npm install, the package's preinstall script preinstall.js collects the installer's hostname, OS username, current working directory, and a...
Malicious code in nrwl.angular-console (VSCode:https://open-vsx.org)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 12636eadc931d19fc68ca6d30f5397404c6b782a67537c770c944ed9337a4125 The compromised version of the Nx Console VS Code extension contains malicious code injected into its main execution file. When a develope...
Server-side Request Forgery (SSRF)
Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the processing of absolute-form URLs in the server-side rendering engine. An attacker can redirect internal HTTP...
@afd-software/angular-ng-autocomplete (=14.0.0), @angularexpert/my-workspace (=0.0.0) +143 more potentially affected by CVE-2026-46417 via @angular/platform-server (>=0.0.0-0 <=18.2.14)
@angular/platform-server NPM version =0.0.0-0, =1.0.0, =0.0.1, =2.0.0, =0.0.6, =19.3.0, =1.5.0, =1.4.1, =1.5.2 - @nani-creative-labs/app-builder =1.0.0 - @nger/angular =1.0.3 - @nk-spirit/nk-ngx-bootstrap =7.1.16 and more Source cves: CVE-2026-46417 Source advisory: OSV:GHSA-RFH7-FXQC-Q52V...
@angular/platform-server: SSRF via Hostname Hijacking
Impact A Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering SSR engine processes the request URL provided to the rendering entry points. When an absolute-form URL e.g., http://evil.com is passed to the rendering...
GHSA-RFH7-FXQC-Q52V @angular/platform-server: SSRF via Hostname Hijacking
Impact A Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering SSR engine processes the request URL provided to the rendering entry points. When an absolute-form URL e.g., http://evil.com is passed to the rendering...
CVE-2025-40900
An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing an Angular template payload, or a victim can be socially engineered to...
CVE-2025-40900 Angular template injection in Reports in Guardian/CMC before 26.1.0
An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing an Angular template payload, or a victim can be socially engineered to...
CVE-2025-40900 Angular template injection in Reports in Guardian/CMC before 26.1.0
An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing an Angular template payload, or a victim can be socially engineered to...
CVE-2025-40900
CVE-2025-40900 describes an Angular template injection in the Reports functionality of Guardian/CMC prior to version 26.1.0. An authenticated user with report privileges can embed an Angular template payload in a malicious report, which executes in the victim’s browser during viewing/import, pote...
CVE-2025-40900
An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing an Angular template payload, or a victim can be socially engineered to...
EUVD-2025-209892
An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing an Angular template payload, or a victim can be socially engineered to...
PT-2026-41887
An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing an Angular template payload, or a victim can be socially engineered to...
Malicious code in @antv/x6-angular-shape (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Nozomi Networks CMC和Nozomi Networks Guardian 安全漏洞
Nozomi Networks CMC and Nozomi Networks Guardian are both products of Nozomi Networks, a company based in the United States. Nozomi Networks CMC is a network management platform. Nozomi Networks Guardian is a security software. Both Nozomi Networks CMC and Nozomi Networks Guardian have security...
Angular template injection in Reports in Guardian/CMC before 26.1.0
Summary An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. Impact An authenticated user with report privileges can define a malicious report containing an Angular template payload, or a victim can be socially...
@baloise/design-system-components (>=0.0.0 <=15.2.4), @baloise/design-system-components-angular (>=0.0.0-nightly-20230817143308 <=15.2.4) +27 more potentially affected by unknown CVE via filesize.js (=2.0.0)
filesize.js NPM version =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on filesize.js and may be impacted: - @baloise/design-system-components =0.0.0, =0.0.0-nightly-20230817143308, =0.0.0, =0.0.0-nightly-20230817143308,...