How many CVEs does angular angular-cli have?

angular angular-cli has 6 published CVE records since 2025.

How many angular angular-cli CVEs are in CISA KEV?

None of angular angular-cli's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for angular angular-cli vulnerabilities?

Yes — 3 of angular angular-cli's CVEs have a known public exploit.

Which versions of angular angular-cli are affected?

449 distinct angular angular-cli versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in angular angular-cli CVEs?

angular angular-cli's CVEs most often map to these CWE weakness types: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')).

How many critical angular angular-cli vulnerabilities are there?

angular angular-cli has 1 critical and 2 high-severity CVEs.

What is the average severity of angular angular-cli CVEs?

The average CVSS base score across angular angular-cli's scored CVEs is 7.6.

angular angular-cli Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every angular angular-cli version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

20.0.0-next.04 CVEs
20.0.0-next.14 CVEs
20.0.0-next.24 CVEs
20.0.0-next.34 CVEs
20.0.0-next.44 CVEs
20.0.0-next.54 CVEs
20.0.0-next.64 CVEs
20.0.0-next.74 CVEs
20.0.0-next.84 CVEs
20.1.0-next.04 CVEs
20.1.0-next.14 CVEs
20.1.0-next.24 CVEs
20.1.0-next.34 CVEs
20.2.04 CVEs
20.2.0-next.04 CVEs
20.2.0-next.14 CVEs
20.2.0-next.24 CVEs
20.2.0-next.34 CVEs
20.2.0-rc.04 CVEs
20.2.0-rc.14 CVEs
20.2.14 CVEs
20.2.24 CVEs
20.3.04 CVEs
20.3.0-rc.04 CVEs
20.3.14 CVEs
20.3.24 CVEs
20.3.34 CVEs
20.3.44 CVEs
20.3.54 CVEs
21.0.0-next.04 CVEs
21.0.0-next.14 CVEs
21.0.0-next.24 CVEs
21.0.0-next.34 CVEs
21.0.0-next.44 CVEs
21.0.0-next.54 CVEs
21.0.0-next.64 CVEs
21.0.0-next.74 CVEs
19.0.0-next.03 CVEs
19.0.0-next.13 CVEs
19.0.0-next.103 CVEs
19.0.0-next.113 CVEs
19.0.0-next.123 CVEs
19.0.0-next.23 CVEs
19.0.0-next.33 CVEs
19.0.0-next.43 CVEs
19.0.0-next.53 CVEs
19.0.0-next.63 CVEs
19.0.0-next.73 CVEs
19.0.0-next.83 CVEs
19.0.0-next.93 CVEs
19.1.0-next.03 CVEs
19.1.0-next.13 CVEs
19.1.0-next.23 CVEs
19.2.03 CVEs
19.2.0-next.03 CVEs
19.2.0-next.13 CVEs
19.2.0-next.23 CVEs
19.2.0-rc.03 CVEs
19.2.13 CVEs
19.2.103 CVEs
19.2.113 CVEs
19.2.123 CVEs
19.2.133 CVEs
19.2.143 CVEs
19.2.153 CVEs
19.2.163 CVEs
19.2.173 CVEs
19.2.23 CVEs
19.2.33 CVEs
19.2.43 CVEs
19.2.53 CVEs
19.2.63 CVEs
19.2.73 CVEs
19.2.83 CVEs
19.2.93 CVEs
20.3.103 CVEs
20.3.113 CVEs
20.3.123 CVEs
20.3.133 CVEs
20.3.143 CVEs
20.3.153 CVEs
20.3.163 CVEs
20.3.63 CVEs
20.3.73 CVEs
20.3.83 CVEs
20.3.93 CVEs
21.0.0-next.83 CVEs
21.1.0-next.03 CVEs
21.1.0-next.13 CVEs
21.1.0-next.23 CVEs
21.1.0-next.33 CVEs
21.2.0-next.23 CVEs
>= 20.0.0-next.0, < 20.3.172 CVEs
>= 21.0.0-next.0, < 21.1.52 CVEs
>= 21.2.0-next.2, < 21.2.0-rc.02 CVEs
19.2.182 CVEs
19.2.192 CVEs
19.2.202 CVEs
21.1.02 CVEs
21.1.0-rc.02 CVEs
21.1.12 CVEs
21.1.22 CVEs
21.1.32 CVEs
21.1.42 CVEs
< 19.2.211 CVE
>= 19.0.0-next.0, < 19.2.211 CVE
>= 19.0.0-next.0, < 19.2.251 CVE
>= 20.0.0-next.0, < 20.3.211 CVE
>= 20.0.0-next.0, < 20.3.251 CVE
>= 21.0.0-next.0, < 21.2.31 CVE
>= 21.0.0-next.0, < 21.2.91 CVE
>= 22.0.0-next.0, < 22.0.0-next.21 CVE
>= 22.0.0-next.0, < 22.0.0-next.71 CVE
>=19.0.0-next.0, < 19.2.181 CVE
>=20.0.0-next.0, < 20.3.61 CVE
>=21.0.0-next.0, < 21.0.0-next.81 CVE
0.0.131 CVE
0.0.141 CVE
0.0.151 CVE
0.0.161 CVE
0.0.171 CVE
0.0.181 CVE
0.0.191 CVE
0.0.201 CVE
0.0.211 CVE
0.0.221 CVE
0.0.231 CVE
0.0.241 CVE
0.0.251 CVE
0.0.271 CVE
0.0.291 CVE
0.0.301 CVE
0.0.311 CVE
0.0.331 CVE
0.0.341 CVE
0.0.351 CVE
0.0.371 CVE
0.0.391 CVE
0.1.01 CVE
1.0.01 CVE
1.0.0-beta.01 CVE
1.0.0-beta.11 CVE
1.0.0-beta.101 CVE
1.0.0-beta.10-webpack1 CVE
1.0.0-beta.11-webpack.21 CVE
1.0.0-beta.141 CVE
1.0.0-beta.151 CVE
1.0.0-beta.171 CVE
1.0.0-beta.181 CVE
1.0.0-beta.191 CVE
1.0.0-beta.2-mobile1 CVE
1.0.0-beta.2-mobile.31 CVE
1.0.0-beta.20-11 CVE
1.0.0-beta.211 CVE
1.0.0-beta.221 CVE
1.0.0-beta.22-11 CVE
1.0.0-beta.231 CVE
1.0.0-beta.261 CVE
1.0.0-beta.281 CVE
1.0.0-beta.301 CVE
1.0.0-beta.311 CVE
1.0.0-beta.321 CVE
1.0.0-beta.41 CVE
1.0.0-beta.51 CVE
1.0.0-beta.61 CVE
1.0.0-beta.91 CVE
1.0.0-rc.01 CVE
1.0.0-rc.11 CVE
1.0.0-rc.21 CVE
1.0.0-rc.41 CVE
1.0.11 CVE
1.4.0-beta.11 CVE
1.5.0-beta.01 CVE
10.0.0-next.01 CVE
10.0.0-next.11 CVE
10.0.0-next.21 CVE
10.0.0-next.31 CVE
10.0.0-next.41 CVE
10.0.0-next.51 CVE
10.0.0-next.61 CVE
10.0.0-rc.01 CVE
10.1.0-next.01 CVE
10.1.0-next.11 CVE
10.1.0-next.21 CVE
10.1.0-next.31 CVE
10.1.0-next.41 CVE
10.1.0-next.51 CVE
10.1.0-next.61 CVE
10.1.0-next.71 CVE
11.0.0-next.01 CVE
11.0.0-next.11 CVE
11.0.0-next.21 CVE
11.0.0-next.31 CVE
11.0.0-next.41 CVE
11.0.0-next.51 CVE
11.0.0-next.61 CVE
11.0.0-next.71 CVE
11.1.0-next.01 CVE
11.1.0-next.11 CVE
11.1.0-next.21 CVE
11.1.0-next.31 CVE
11.1.0-next.41 CVE
11.2.0-next.01 CVE
12.0.0-next.01 CVE
12.0.0-next.11 CVE
12.0.0-next.21 CVE
12.0.0-next.31 CVE
12.0.0-next.41 CVE
12.0.0-next.51 CVE
12.0.0-next.61 CVE
12.0.0-next.71 CVE
12.0.0-next.81 CVE
12.0.0-next.91 CVE
12.1.01 CVE
12.1.0-next.21 CVE
12.1.0-next.31 CVE
12.1.0-next.41 CVE
12.1.0-next.51 CVE
12.1.0-next.61 CVE
12.2.0-next.01 CVE
12.2.0-next.11 CVE
12.2.0-next.21 CVE
12.2.0-next.31 CVE
13.0.0-next.01 CVE
13.0.0-next.11 CVE
13.0.0-next.21 CVE
13.0.0-next.31 CVE
13.0.0-next.41 CVE
13.0.0-next.51 CVE
13.0.0-next.61 CVE
13.0.0-next.71 CVE
13.0.0-next.81 CVE
13.1.0-next.01 CVE
13.1.0-next.11 CVE
13.1.0-next.21 CVE
13.1.0-next.31 CVE
13.2.0-next.01 CVE
13.2.0-next.11 CVE
13.2.0-next.21 CVE
14.0.0-next.01 CVE
14.0.0-next.11 CVE
14.0.0-next.101 CVE
14.0.0-next.111 CVE
14.0.0-next.121 CVE
14.0.0-next.21 CVE
14.0.0-next.31 CVE
14.0.0-next.41 CVE
14.0.0-next.51 CVE
14.0.0-next.61 CVE
14.0.0-next.71 CVE
14.0.0-next.81 CVE
14.0.0-next.91 CVE
14.1.0-next.01 CVE
14.1.0-next.11 CVE
14.1.0-next.21 CVE
14.1.0-next.31 CVE
14.1.0-next.41 CVE
14.2.0-next.01 CVE
14.2.0-next.11 CVE
14.2.0-next.21 CVE
15.0.0-next.01 CVE
15.0.0-next.11 CVE
15.0.0-next.21 CVE
15.0.0-next.31 CVE
15.0.0-next.41 CVE
15.1.0-next.01 CVE
15.1.0-next.11 CVE
15.1.0-next.21 CVE
15.1.0-next.31 CVE
15.2.0-next.01 CVE
15.2.0-next.11 CVE
15.2.0-next.21 CVE
15.2.0-next.31 CVE
15.2.0-next.41 CVE
16.0.0-next.01 CVE
16.0.0-next.11 CVE
16.0.0-next.21 CVE
16.0.0-next.31 CVE
16.0.0-next.41 CVE
16.0.0-next.51 CVE
16.0.0-next.61 CVE
16.1.0-next.01 CVE
16.1.0-next.11 CVE
16.1.0-next.21 CVE
16.2.01 CVE
16.2.0-next.01 CVE
16.2.0-next.11 CVE
16.2.0-next.21 CVE
16.2.0-next.31 CVE
16.2.0-next.41 CVE
16.2.0-rc.01 CVE
16.2.0-rc.11 CVE
17.0.0-next.01 CVE
17.0.0-next.11 CVE
17.0.0-next.21 CVE
17.0.0-next.31 CVE
17.0.0-next.51 CVE
17.0.0-next.61 CVE
17.0.0-next.71 CVE
17.0.0-next.81 CVE
17.0.0-next.91 CVE
17.1.0-next.01 CVE
17.1.0-next.11 CVE
17.1.0-next.21 CVE
17.1.0-next.31 CVE
17.2.0-next.01 CVE
17.2.0-next.11 CVE
18.0.0-next.01 CVE
18.0.0-next.11 CVE
18.0.0-next.21 CVE
18.0.0-next.31 CVE
18.0.0-next.41 CVE
18.1.0-next.01 CVE
18.1.0-next.11 CVE
18.1.0-next.21 CVE
18.1.0-next.31 CVE
18.2.0-next.01 CVE
18.2.0-next.11 CVE
18.2.0-next.21 CVE
18.2.0-next.31 CVE
20.3.171 CVE
20.3.181 CVE
20.3.191 CVE
20.3.201 CVE
21.2.01 CVE
21.2.0-next.01 CVE
21.2.0-next.11 CVE
21.2.0-rc.01 CVE
21.2.0-rc.11 CVE
21.2.0-rc.21 CVE
21.2.11 CVE
21.2.21 CVE
22.0.0-next.01 CVE
22.0.0-next.11 CVE
22.0.0-next01 CVE
22.0.0-next11 CVE
22.0.0-next21 CVE
22.0.0-next31 CVE
22.0.0-next41 CVE
22.0.0-next51 CVE
22.0.0-next61 CVE
6.0.01 CVE
6.0.0-beta.31 CVE
6.0.0-beta.51 CVE
6.0.0-beta.61 CVE
6.0.0-beta.71 CVE
6.0.0-beta.81 CVE
6.0.0-beta.91 CVE
6.0.0-rc.01 CVE
6.0.0-rc.11 CVE
6.0.0-rc.101 CVE
6.0.0-rc.21 CVE
6.0.0-rc.31 CVE
6.0.0-rc.41 CVE
6.0.0-rc.51 CVE
6.0.0-rc.61 CVE
6.0.0-rc.71 CVE
6.0.0-rc.91 CVE
6.2.0-beta.01 CVE
6.2.0-beta.11 CVE
6.2.0-beta.21 CVE
6.2.0-beta.31 CVE
6.2.0-rc.01 CVE
7.0.0-beta.21 CVE
7.0.0-beta.31 CVE
7.0.0-beta.41 CVE
7.0.0-rc.01 CVE
7.0.0-rc.21 CVE
7.0.0-rc.31 CVE
7.1.0-beta.01 CVE
7.1.0-beta.11 CVE
7.1.0-rc.01 CVE
7.2.0-beta.01 CVE
7.2.0-beta.11 CVE
7.2.0-beta.21 CVE
7.2.0-rc.01 CVE
7.3.0-beta.01 CVE
7.3.0-rc.01 CVE
8.0.0-beta.01 CVE
8.0.0-beta.11 CVE
8.0.0-beta.101 CVE
8.0.0-beta.111 CVE
8.0.0-beta.121 CVE
8.0.0-beta.131 CVE
8.0.0-beta.141 CVE
8.0.0-beta.151 CVE
8.0.0-beta.161 CVE
8.0.0-beta.171 CVE
8.0.0-beta.181 CVE
8.0.0-beta.21 CVE
8.0.0-beta.31 CVE
8.0.0-beta.41 CVE
8.0.0-beta.51 CVE
8.0.0-beta.61 CVE
8.0.0-beta.71 CVE
8.0.0-beta.81 CVE
8.0.0-beta.91 CVE
8.1.01 CVE
8.1.0-beta.01 CVE
8.1.0-beta.11 CVE
8.1.0-beta.21 CVE
8.1.0-beta.31 CVE
8.1.0-rc.01 CVE
8.2.0-next.01 CVE
8.2.0-next.11 CVE
8.2.0-next.21 CVE
8.2.0-rc.01 CVE
8.3.0-next.01 CVE
8.3.0-next.11 CVE
8.3.0-next.21 CVE
8.3.0-rc.01 CVE
9.0.0-next.01 CVE
9.0.0-next.11 CVE
9.0.0-next.101 CVE
9.0.0-next.111 CVE
9.0.0-next.121 CVE
9.0.0-next.131 CVE
9.0.0-next.141 CVE
9.0.0-next.151 CVE
9.0.0-next.161 CVE
9.0.0-next.171 CVE
9.0.0-next.181 CVE
9.0.0-next.191 CVE
9.0.0-next.21 CVE
9.0.0-next.31 CVE
9.0.0-next.41 CVE
9.0.0-next.51 CVE
9.0.0-next.61 CVE
9.0.0-next.71 CVE
9.0.0-next.81 CVE
9.0.0-next.91 CVE
9.1.0-next.01 CVE
9.1.0-next.11 CVE
9.1.0-next.21 CVE
9.1.0-next.31 CVE
9.1.0-next.41 CVE

Fixed in

0ad7cc38e13229ab3d081180dbe3a15ff9c9024f2 CVEs
4d9442a236bb37b95b8a8602389f87716407149c2 CVEs
99ded1d45b1cf30cf107a69addf95611342a23e42 CVEs
c0d1626e87b807845d898e30f52e2251aa81c2a02 CVEs
08e13a84fd3d916fceedb68fdffe2870f44e7ac71 CVE
110a2278dc67f92f90a2535ea2616e6d26989ddf1 CVE
1aa23cd04bb606f580788f88d7ab30ecd508813e1 CVE
34d524549b68912f8ebe4e656a342b797161d2321 CVE
564b1084e2bfb0813f374f1bff6f6ec5867b4bc21 CVE
8590f19236e2ccc30c0b93c415ee716933628e931 CVE
985e58075fb48c8cc1bc0d3075d2e1d41fe31433

Find a version

6 CVEs

Sort

Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
CVE-2026-44437
Patch
CWE-22
Medium · CVSS 6.9
EPSS 0.2% (10th pct)2026-05-13
Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass
CVE-2026-33397
Patch
CWE-601
Medium · CVSS 6.9
EPSS 0.3% (17th pct)2026-03-26
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
CVE-2026-27739
Public exploit
Patch
CWE-918
Critical · CVSS 9.2
EPSS 0.5% (40th pct)2026-02-25
Angular SSR has an Open Redirect via X-Forwarded-Prefix
CVE-2026-27738
Public exploit
Patch
CWE-601
Medium · CVSS 6.9
EPSS 0.3% (22th pct)2026-02-25
Server-Side Request Forgery (SSRF) in Angular SSR
CVE-2025-62427
Public exploit
Patch
CWE-918
High · CVSS 8.7
EPSS 0.4% (33th pct)2025-10-16
Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage
CVE-2025-59052
Patch
CWE-362
High · CVSS 7.1
EPSS 0.3% (25th pct)2025-09-10

angular angular-cli Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Fixed in

Common weakness types

Disclosure activity by year

Other angular products

Frequently asked questions

References

Track angular angular-cli vulnerabilities