@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-50168 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-50168 Source advisory: OSV:GHSA-XRXM-CP7J-8XF6...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-50168 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-50168 Source advisory: GHSA-XRXM-CP7J-8XF6...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-50168 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-50168 Source advisory: OSV:GHSA-XRXM-CP7J-8XF6...

PT-2026-49566

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.16 Angular versions prior to 20.3.24 Angular versions prior to 19.2.25 Description A Cross-Site Scripting XSS issue exists in the DOM emulation dependency domino used by...

ch.sbb.releasetrain:jsfbootadapter (0.0.25), ch.sbb.releasetrain:webui (0.0.25) +343 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (4.2.7.release)

org.springframework:spring-webmvc MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.sbb.releasetrain:jsfbootadapter 0.0.25 - ch.sbb.releasetrain:webui 0.0.25 -...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.0), com.canoo.dolphin-platform:dolphin-platform-server-spring (>=0.6.1, <=0.8.6) +158 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (4.1.5.release)

org.springframework:spring-webmvc MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay 1.0 -...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.0), com.canoo.dolphin-platform:dolphin-platform-server-spring (>=0.6.1, <=0.8.6) +158 more potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (4.1.5.release)

org.springframework:spring-webmvc MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay 1.0 -...

ch.sbb.releasetrain:jsfbootadapter (0.0.25), ch.sbb.releasetrain:webui (0.0.25) +343 more potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (4.2.7.release)

org.springframework:spring-webmvc MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.sbb.releasetrain:jsfbootadapter 0.0.25 - ch.sbb.releasetrain:webui 0.0.25 -...

CVE-2026-41423

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8, a Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server due to improper...

@angular/platform-server: SSRF via Hostname Hijacking

Impact A Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering SSR engine processes the request URL provided to the rendering entry points. When an absolute-form URL e.g., http://evil.com is passed to the rendering...

GHSA-RFH7-FXQC-Q52V @angular/platform-server: SSRF via Hostname Hijacking

Impact A Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering SSR engine processes the request URL provided to the rendering entry points. When an absolute-form URL e.g., http://evil.com is passed to the rendering...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-46417 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-46417 Source advisory: OSV:GHSA-RFH7-FXQC-Q52V...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-46417 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-46417 Source advisory: GHSA-RFH7-FXQC-Q52V...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-46417 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-46417 Source advisory: GHSA-RFH7-FXQC-Q52V...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-46417 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-46417 Source advisory: OSV:GHSA-RFH7-FXQC-Q52V...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-46417 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-46417 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-16770437...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4), @irshadali/ngx-indexed-db (>=19.3.0, <=19.3.1) +16 more potentially affected by CVE-2026-46417 via @angular/platform-server (>=18.2.13, <=18.2.14)

@angular/platform-server NPM version =18.2.13, =1.0.0, =19.3.0, =0.0.0, =12.0.0, =0.0.0, =1.0.2, =0.0.0, =1.0.0, =0.0.1, =0.0.2 - my-unique-workspace 0.0.0 - my-workspace01 0.0.0 and more Source cves: CVE-2026-46417 Source advisory: OSV:GHSA-RFH7-FXQC-Q52V...

Server-side Request Forgery (SSRF)

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the processing of absolute-form URLs in the server-side rendering engine. An attacker can redirect internal HTTP...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4), @irshadali/ngx-indexed-db (>=19.3.0, <=19.3.1) +16 more potentially affected by CVE-2026-46417 via @angular/platform-server (>=18.2.13, <=18.2.14)

@angular/platform-server NPM version =18.2.13, =1.0.0, =19.3.0, =0.0.0, =12.0.0, =0.0.0, =1.0.2, =0.0.0, =1.0.0, =0.0.1, =0.0.2 - my-unique-workspace 0.0.0 - my-workspace01 0.0.0 and more Source cves: CVE-2026-46417 Source advisory: GHSA-RFH7-FXQC-Q52V...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-46417 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-46417 Source advisory:...