https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:29:41.731861+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-343969 EUVD-2026-343969 2026-10-02T19:29:41.798759+00:00 EUVD-2026-343969 https://cve.radiocsirt.org/vuln/fkie_cve-2026-69149 fkie_cve-2026-69149 2026-10-02T19:29:41.798795+00:00

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.

 https://cve.radiocsirt.org/vuln/ghsa-vpx6-8pjr-4g3v GHSA-vpx6-8pjr-4g3v — Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) 2026-10-02T19:29:41.798831+00:00

Affected: npm: @angular/platform-server

A Cross-Site Scripting (XSS) vulnerability exists in `@angular/platform-server`'s DOM emulation dependency (`domino`) when serializing the content of fallback raw-content elements (`<iframe>`, `<noembed>`, `<noframes>`, and `<noscript>`).

When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), `domino` is configured with scripting enabled, meaning these elements are treated as raw-text elements.

However, `domino`'s serializer previously did not escape text nodes within fallback raw-content elements (`<iframe>`, `<noembed>`, `<noframes>`, `<noscript>`) during DOM serialization. As a result, any occurrence of closing tags in the bound dynamic text was not escaped.

The unescaped closing tag could be serialized directly into the output HTML. When parsed by a browser or re-parsed during SSR post-processing without preserving raw-content parser state, an injected closing tag closes the element early, allowing an injected script block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS).

### Impact

This vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside fallback raw-content elements (`<iframe>`, `<noembed>`, `<noframes>`, `<noscript>`). This can lead to session hijacking, cre…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-69149 UBUNTU-CVE-2026-69149 2026-10-02T19:29:41.798883+00:00

Affected: Ubuntu:Pro:16.04:LTS: angular.js, Ubuntu:Pro:18.04:LTS: angular.js, Ubuntu:Pro:20.04:LTS: angular.js, Ubuntu:22.04:LTS: angular.js, Ubuntu:24.04:LTS: angular.js, Ubuntu:26.04:LTS: angular.js

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2632 WID-SEC-W-2026-2632 — Angular: Mehrere Schwachstellen 2026-10-02T19:29:41.798913+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um Dateien zu manipulieren und Cross-Site-Scripting-Angriffe durchzuführen.