Exposição de Angular

JavaScript frameworks
52
score de exposição
118.500
sites usam
0
em exploração
0
críticos
Análise Vexday

O histórico de vulnerabilidades do Angular soma 30 CVEs catalogadas, com zero registros de exploração ativa no catálogo KEV da CISA, taxa abaixo da média geral do catálogo. Não há falhas de severidade crítica no conjunto, e o maior valor EPSS observado é de aproximadamente 0,053, indicando probabilidade de exploração relativamente baixa em todo o portfólio. O ponto de atenção mais relevante é a concentração de falhas do tipo CWE-79 (Cross-Site Scripting), padrão dominante na base, e o volume expressivo de 18 CVEs surgidas nos últimos 90 dias, o que sugere um ciclo recente de descobertas que demanda acompanhamento próximo. A CVE mais perigosa atualmente identificada é a CVE-2022-25869, com EPSS de 0,0528, reforçando que, apesar da ausência de exploração confirmada, equipes que mantêm versões desatualizadas do framework devem priorizar a aplicação dos patches disponíveis.

CVEs

45 resultados
CVE-2026-50170HIGHAngular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCacheEPSS 0.4%CVE-2026-69149HIGHAngular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)EPSS 0.4%CVE-2026-50556HIGHAngular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSREPSS 0.4%CVE-2026-50557MEDIUMAngular: Template and Attribute Namespace Sanitization Bypass (XSS)EPSS 0.4%CVE-2026-54264HIGHAngular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service WorkerEPSS 0.4%CVE-2025-66412HIGHAngular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML AttributesEPSS 0.4%CVE-2026-54267HIGHAngular Client Hydration DOM Clobbering & Response-Cache PoisoningEPSS 0.4%CVE-2026-88057MEDIUMAngular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilerEPSS 0.4%CVE-2026-88060HIGHAngular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content ElementsEPSS 0.4%CVE-2026-46417HIGHAngular: SSRF via Hostname Hijacking in @angular/platform-serverEPSS 0.4%CVE-2025-59052HIGHAngular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data LeakageEPSS 0.4%CVE-2026-101897MEDIUMAngular DevTools (Local DoS)EPSS 0.4%CVE-2026-54265MEDIUMAngular: Two-Way Property Binding Sanitization Bypass (XSS)EPSS 0.3%CVE-2026-88059MEDIUMAngular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`EPSS 0.3%CVE-2026-69151HIGHAngular i18n: Cross-Site Scripting (XSS) via event-handler attributesEPSS 0.3%CVE-2026-41423HIGHAngular: SSRF via protocol-relative and backslash URLs in Angular Platform-ServerEPSS 0.3%CVE-2026-88058HIGHAngular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content ElementsEPSS 0.3%CVE-2026-50555HIGHAngular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-serverEPSS 0.3%CVE-2026-50171HIGHAngular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)EPSS 0.3%CVE-2026-49241HIGHAngular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code ExtensionEPSS 0.2%