These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-50555 is a high-severity Cross-Site Scripting (XSS) vulnerability in Angular's @angular/platform-server's DOM emulation dependency (domino). The vulnerability exists when serializing the content of raw-text elements, such as <script>, <style>, and <iframe>, due to a Unicode index alignment bug in the escaping logic. This bug allows an attacker to supply a payload containing both an astral Unicode [truncated]
CVE-2026-50170 is a high-severity information disclosure vulnerability in Angular's @angular/common module when Server-Side Rendering (SSR) and hydration are enabled. The vulnerability arises from the HttpTransferCache utility's failure to inspect the withCredentials flag or the Cookie header of outgoing requests, potentially leading to the caching and leakage of user-specific, credentialed responses. Thi [truncated]
CVE-2026-50169 is a medium-severity vulnerability affecting the Angular service worker. Prior to versions 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, the service worker incorrectly reconstructs requests, stripping client-defined redirect policies. This can lead to unintended proxy behavior, potentially exposing sensitive data. The vulnerability has a CVSS score of 5.7 and is classified as CWE-200, CWE-441 [truncated]
CVE-2026-54268 is a high-severity Denial of Service (DoS) vulnerability in the @angular/common package of the Angular framework. The vulnerability is caused by the formatDate function, which is also utilized by the standard Angular DatePipe, not properly limiting or validating the length of the format parameter. This results in uncontrolled resource consumption (high CPU utilization and excessive memory a [truncated]
The CVE-2026-54267 vulnerability is a high-severity issue affecting Angular, a popular development platform for building mobile and desktop web applications. This vulnerability, which has a CVSS score of 8.6, is caused by Angular's client-side hydration feature in Server-Side Rendered (SSR) environments. The vulnerability allows an attacker to exploit DOM clobbering by manipulating the application's runti [truncated]
CVE-2026-54266 is a high-severity vulnerability in Angular's HttpTransferCache, which caches HTTP requests made during Server-Side Rendering (SSR). The vulnerability allows attackers to find hash collisions, enabling them to overwrite sensitive data. The issue is fixed in Angular versions 22.0.1, 21.2.17, and 20.3.25. The vulnerability has a CVSS score of 8.8 and is considered high-severity. The CVE recor [truncated]
CVE-2026-54265 is a medium-severity vulnerability in the @angular/compiler package of the Angular development platform. The issue allows an attacker to bypass DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization, such as innerHTML or src, is bound using the two-way binding syntax, the Angular template compiler fails to [truncated]
CVE-2026-54264 is an information disclosure vulnerability in the @angular/service-worker package of the Angular framework. Prior to 22.0.1, 21.2.17, and 20.3.25, the Service Worker preserves metadata from the original request when fetching assets, but fails to strip sensitive headers on cross-origin redirects. This allows a remote attacker to obtain sensitive credentials by triggering a cross-origin redir [truncated]
CVE-2026-52725 is a medium-severity vulnerability in the Angular development platform. The issue, located in the @angular/core package, enables an attacker to bypass script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism failed to reject mounting components directly onto a <script> or namespaced script element. This flaw allows an attac [truncated]
CVE-2026-50557 is a medium-severity vulnerability in Angular that allows an attacker to bypass element and attribute sanitization/validation, leading to client-side Cross-Site Scripting (XSS). The issue arises from the improper identification of namespaced script elements and inconsistent handling of attributes within namespaced elements. This vulnerability affects various versions of Angular, including t [truncated]
The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. Prior to 21.2.4, the client-side Angular Language Service VS Code extension reads custom TypeScript SDK paths directly from workspace configurations without verifying VS Code Workspace Trust state or asking for user consent. An attacker can exploit this behavior by committing a repository containing a [truncated]