https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:32:21 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/euvd-2026-329213 EUVD-2026-329213 https://cve.radiocsirt.org/vuln/euvd-2026-329213 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50184 <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: &#39;omit&#39;) and the HTTP cache mode configuration (such as cache: &#39;no-store&#39;). These are reverted back to standard browser-default parameters (credentials: &#39;same-origin&#39; and default HTTP cache properties). This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker&#39;s engine, making private page states accessible or persistent inside the client&#39;s local cache post-logout. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: &#39;omit&#39;) and the HTTP cache mode configuration (such as cache: &#39;no-store&#39;). These are reverted back to standard browser-default parameters (credentials: &#39;same-origin&#39; and default HTTP cache properties). This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker&#39;s engine, making private page states accessible or persistent inside the client&#39;s local cache post-logout. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50184 https://cve.radiocsirt.org/vuln/ghsa-95qp-cmmw-mgqv <p><strong>Affected:</strong> npm: @angular/service-worker</p> <p>An issue in the `@angular/service-worker` package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new `Request` object using an internal helper function.</p> <p>During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as `credentials: &#39;omit&#39;`) and the HTTP `cache` mode configuration (such as `cache: &#39;no-store&#39;`). These are reverted back to standard browser-default parameters (`credentials: &#39;same-origin&#39;` and default HTTP cache properties).</p> <p>This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker&#39;s engine, making private page states accessible or persistent inside the client&#39;s local cache post-logout.</p> <p>### Impact Web applications registering the `@angular/service-worker` package are vulnerable to credential exposure or post-logout cache persistence if client-side code relies on fetch calls with explicit safety attributes (such as `{ credentials: &#39;omit&#39; }` or `{ cache: &#39;no-store&#39; }`) targeting paths matched by service worker asset groups.</p> <p>By stripping these safety boundaries, the service worker exp…</p> <p><strong>Affected:</strong> npm: @angular/service-worker</p> <p>An issue in the `@angular/service-worker` package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new `Request` object using an internal helper function.</p> <p>During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as `credentials: &#39;omit&#39;`) and the HTTP `cache` mode configuration (such as `cache: &#39;no-store&#39;`). These are reverted back to standard browser-default parameters (`credentials: &#39;same-origin&#39;` and default HTTP cache properties).</p> <p>This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker&#39;s engine, making private page states accessible or persistent inside the client&#39;s local cache post-logout.</p> <p>### Impact Web applications registering the `@angular/service-worker` package are vulnerable to credential exposure or post-logout cache persistence if client-side code relies on fetch calls with explicit safety attributes (such as `{ credentials: &#39;omit&#39; }` or `{ cache: &#39;no-store&#39; }`) targeting paths matched by service worker asset groups.</p> <p>By stripping these safety boundaries, the service worker exp…</p> https://cve.radiocsirt.org/vuln/ghsa-95qp-cmmw-mgqv https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50184 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: angular.js, Ubuntu:Pro:18.04:LTS: angular.js, Ubuntu:Pro:20.04:LTS: angular.js, Ubuntu:22.04:LTS: angular.js, Ubuntu:24.04:LTS: angular.js, Ubuntu:25.10: angular.js, Ubuntu:26.04:LTS: angular.js</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: &#39;omit&#39;) and the HTTP cache mode configuration (such as cache: &#39;no-store&#39;). These are reverted back to standard browser-default parameters (credentials: &#39;same-origin&#39; and default HTTP cache properties). This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker&#39;s engine, making private page states accessible or persistent inside the client&#39;s local cache post-logout. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: angular.js, Ubuntu:Pro:18.04:LTS: angular.js, Ubuntu:Pro:20.04:LTS: angular.js, Ubuntu:22.04:LTS: angular.js, Ubuntu:24.04:LTS: angular.js, Ubuntu:25.10: angular.js, Ubuntu:26.04:LTS: angular.js</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: &#39;omit&#39;) and the HTTP cache mode configuration (such as cache: &#39;no-store&#39;). These are reverted back to standard browser-default parameters (credentials: &#39;same-origin&#39; and default HTTP cache properties). This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker&#39;s engine, making private page states accessible or persistent inside the client&#39;s local cache post-logout. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50184 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1930 <p>Ein Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, einen Denial-of-Service-Zustand herbeizuführen, Daten zu manipulieren oder offenzulegen, Benutzer auf bösartige Websites umzuleiten oder Sitzungen zu kapern.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, einen Denial-of-Service-Zustand herbeizuführen, Daten zu manipulieren oder offenzulegen, Benutzer auf bösartige Websites umzuleiten oder Sitzungen zu kapern.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1930