Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,206All CVEsplus 19,120 rejected
- 498Last 24 hours2,815 in the last 7 days
- 16,883Last 30 days1,542 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 25 | 14 | 0 | 0 | 40 | 44 |
| 2025 | 0 | 4 | 0 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-111753 | Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)angular · angular | Medium5.9 |
| CVE-2026-111751 | Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)angular · angular | High8.2 |
| CVE-2026-111754 | Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)angular · angular | Medium5.1 |
| CVE-2026-111752 | Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)angular · angular | High8.2 |
| CVE-2026-101896 | Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)angular · angular | High8.2 |
| CVE-2026-101897 | Angular DevTools (Local DoS)angular · angular | Medium5.1 |
| CVE-2026-101895 | Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPEangular · angular | High8.7 |
| CVE-2026-104871 | Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windowsangular · angular-cli | Medium6.3 |
| CVE-2026-88060 | Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elementsangular · angular | High8.6 |
| CVE-2026-88059 | Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`angular · angular | Medium4.0 |
| CVE-2026-88058 | Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elementsangular · angular | High8.6 |
| CVE-2026-88057 | Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilerangular · angular | Medium5.3 |
| CVE-2026-88056 | Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSRangular · angular | High8.6 |
| CVE-2026-69151 | Angular i18n: Cross-Site Scripting (XSS) via event-handler attributesangular · angular | High7.6 |
| CVE-2026-69149 | Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)angular · angular | High8.6 |
| CVE-2026-68945 | Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoningangular · angular | High8.8 |
| CVE-2026-50171 | Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)angular · angular | High8.2 |
| CVE-2026-50184 | Angular: Request Credential & Cache Policy Stripping in Angular Service Workerangular · angular | Medium5.7 |
| CVE-2026-50169 | Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilitiesangular · angular | Medium5.7 |
| CVE-2026-46417 | Angular: SSRF via Hostname Hijacking in @angular/platform-serverangular · angular | High8.8 |
| CVE-2026-50168 | Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypassangular · angular | High8.8 |
| CVE-2026-50170 | Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCacheangular · angular | High8.2 |
| CVE-2026-50556 | Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSRangular · angular | High8.6 |
| CVE-2026-50555 | Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-serverangular · angular | High8.6 |
| CVE-2026-54264 | Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Workerangular · angular | High8.3 |
| CVE-2026-54268 | Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)angular · angular | High8.2 |
| CVE-2026-54267 | Angular Client Hydration DOM Clobbering & Response-Cache Poisoningangular · angular | High8.6 |
| CVE-2026-54266 | Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoningangular · angular | High8.8 |
| CVE-2026-54265 | Angular: Two-Way Property Binding Sanitization Bypass (XSS)angular · angular | Medium5.3 |
| CVE-2026-50178 | Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extensionangular · angular | High8.7 |
| CVE-2026-52725 | Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)angular · angular | Medium5.3 |
| CVE-2026-49241 | Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extensionangular · angular | High8.7 |
| CVE-2026-50557 | Angular: Template and Attribute Namespace Sanitization Bypass (XSS)angular · angular | Medium5.3 |
| CVE-2026-44437 | Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefixangular · angular-cli | Medium6.9 |
| CVE-2026-41423 | Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Serverangular · angular | High8.7 |
| CVE-2026-33397 | Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypassangular · angular-cli | Medium6.9 |
| CVE-2026-27970 | Angular i18n vulnerable to Cross-Site Scripting (XSS)angular · angular | High7.6 |
| CVE-2026-27739 | Angular SSR is vulnerable to SSRF and Header Injection via request handling pipelineangular · angular-cli | Critical9.2 |
| CVE-2026-27738 | Angular SSR has an Open Redirect via X-Forwarded-Prefixangular · angular-cli | Medium6.9 |
| CVE-2026-22610 | Angular has XSS Vulnerability via Unsanitized SVG Script Attributesangular · angular | High8.5 |
| CVE-2025-66412 | Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributesangular · angular | High8.5 |
| CVE-2025-66035 | Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLsangular · angular | High7.7 |
| CVE-2025-62427 | Server-Side Request Forgery (SSRF) in Angular SSRangular · angular-cli | High8.7 |
| CVE-2025-59052 | Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakageangular · angular | High7.1 |