@angular core
2 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-69151 | >= 22.0.0-next.0, < 22.0.1 ; >= 21.0.0-next.0, < 21.2.19 ; < 20.3.27 | Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes | HIGH 7.6 | 0.3 % | ||
| CVE-2026-32635 | >= 22.0.0-next.0, < 22.0.0-next.3 ; >= 21.0.0-next.0, < 21.2.4 ; >= 20.0.0-next.0, < 20.3.18 ; … | Angular has XSS in i18n attribute bindings | HIGH 8.6 | 0.5 % |