Exposición de Angular

JavaScript frameworks
42
score de exposición
118.464
sitios usan
0
en explotación
0
críticos
Análisis Vexday

O histórico de vulnerabilidades do Angular soma 30 CVEs catalogadas, com zero registros de exploração ativa no catálogo KEV da CISA, taxa abaixo da média geral do catálogo. Não há falhas de severidade crítica no conjunto, e o maior valor EPSS observado é de aproximadamente 0,053, indicando probabilidade de exploração relativamente baixa em todo o portfólio. O ponto de atenção mais relevante é a concentração de falhas do tipo CWE-79 (Cross-Site Scripting), padrão dominante na base, e o volume expressivo de 18 CVEs surgidas nos últimos 90 dias, o que sugere um ciclo recente de descobertas que demanda acompanhamento próximo. A CVE mais perigosa atualmente identificada é a CVE-2022-25869, com EPSS de 0,0528, reforçando que, apesar da ausência de exploração confirmada, equipes que mantêm versões desatualizadas do framework devem priorizar a aplicação dos patches disponíveis.

CVEs

38 resultados
CVE-2026-54264HIGHAngular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service WorkerEPSS 0.4%CVE-2026-46417HIGHAngular: SSRF via Hostname Hijacking in @angular/platform-serverEPSS 0.4%CVE-2026-50557MEDIUMAngular: Template and Attribute Namespace Sanitization Bypass (XSS)EPSS 0.3%CVE-2026-54265MEDIUMAngular: Two-Way Property Binding Sanitization Bypass (XSS)EPSS 0.3%CVE-2025-59052HIGHAngular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data LeakageEPSS 0.3%CVE-2026-54267HIGHAngular Client Hydration DOM Clobbering & Response-Cache PoisoningEPSS 0.3%CVE-2026-41423HIGHAngular: SSRF via protocol-relative and backslash URLs in Angular Platform-ServerEPSS 0.3%CVE-2026-88059MEDIUMAngular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`EPSS 0.3%CVE-2026-50555HIGHAngular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-serverEPSS 0.3%CVE-2026-50171HIGHAngular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)EPSS 0.3%CVE-2026-49241HIGHAngular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code ExtensionEPSS 0.2%CVE-2026-50168HIGHAngular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist BypassEPSS 0.2%CVE-2026-50169MEDIUMAngular Service Worker Policy-Bypass & Credential-Stripping VulnerabilitiesEPSS 0.2%CVE-2026-50184MEDIUMAngular: Request Credential & Cache Policy Stripping in Angular Service WorkerEPSS 0.2%CVE-2026-69149HIGHAngular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)EPSS 0.2%CVE-2026-69151HIGHAngular i18n: Cross-Site Scripting (XSS) via event-handler attributesEPSS 0.2%CVE-2026-54266HIGHAngular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State PoisoningEPSS 0.1%CVE-2026-68945HIGHAngular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State PoisoningEPSS 0.1%