@angular/core vulnerabilities
CVEs whose affected-version data names the @angular/core package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-69151HighAngular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
▾ Twilightangular · @angular/compilerEPSS 0.20%via GHSA
CVE-2026-54267HighAngular Client Hydration DOM Clobbering & Response-Cache Poisoning
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
▾ Twilightangular · @angular/coreEPSS 0.32%via GHSA
CVE-2026-52725Medium@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
▾ Sunlitangular · @angular/coreEPSS 0.40%via GHSA
CVE-2026-50557MediumAngular: Template and Attribute Namespace Sanitization Bypass (XSS)
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
▾ Sunlitangular · @angular/coreEPSS 0.34%via GHSA