Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.
Depth = severity + exploitation
CVE-2026-111753Medium@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
CVE-2026-111751High@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
CVE-2026-111754Medium@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
CVE-2026-111752High@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
CVE-2026-101897Medium· 5.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessa…
CVE-2026-101896High· 8.2Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter nam…
CVE-2026-101895High· 8.7PoCAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an inf…
CVE-2026-104871Medium· 6.3The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for ver…
CVE-2026-88057Medium· 6.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compi…
CVE-2026-88059Medium· 4.0Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authentic…
CVE-2026-88056Critical· 9.1PoCAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processe…
CVE-2026-88058Medium· 6.1PoC⚖ disputedAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server se…
CVE-2026-88060Medium· 6.1PoC⚖ disputedAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server se…
CVE-2026-69149HighAngular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
CVE-2026-69151HighAngular i18n: Cross-Site Scripting (XSS) via event-handler attributes
CVE-2026-54267HighAngular Client Hydration DOM Clobbering & Response-Cache Poisoning
CVE-2026-50168High@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
CVE-2026-50169MediumAngular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
CVE-2026-52725Medium@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
CVE-2026-50170High@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
CVE-2026-50171High@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
CVE-2026-50184Medium@angular/service-worker: Request Credential & Cache Policy Stripping
CVE-2026-50555High@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-50557MediumAngular: Template and Attribute Namespace Sanitization Bypass (XSS)
CVE-2026-54265Medium@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
The beta is over. VulnSea now runs at vulnsea.com, every old beta link redirects to the same page, and your account, API keys and watchlists came with it. Plus a round of hardening, faster pages, and new request limits agents should know about.
A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.
A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.