https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:32:35 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0933 certfr-2026-avi-0933 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0933 https://cve.radiocsirt.org/vuln/euvd-2026-328953 EUVD-2026-328953 https://cve.radiocsirt.org/vuln/euvd-2026-328953 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52725 <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a &lt;script&gt; or namespaced script element (such as &lt;svg:script&gt;). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a &lt;script&gt; tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a &lt;script&gt; or namespaced script element (such as &lt;svg:script&gt;). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a &lt;script&gt; tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-52725 https://cve.radiocsirt.org/vuln/ghsa-692r-grfm-v8x7 <p><strong>Affected:</strong> npm: @angular/core</p> <p>An issue in the `@angular/core` package allows bypassing script-execution restrictions during dynamic component creation.</p> <p>Specifically, the dynamic component instantiation mechanism (`createComponent`) failed to reject mounting components directly onto a `&lt;script&gt;` or namespaced script element (such as `&lt;svg:script&gt;`). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts.</p> <p>This flaw enables an attacker who can control the host element or selector parameter passed to `createComponent` to initialize or mount an Angular component directly onto a `&lt;script&gt;` tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS).</p> <p>### Impact Any Angular application that registers dynamic components based on user-supplied parameters (like selectors or host elements) is vulnerable to this security bypass.</p> <p>Once exploited, this allows a malicious actor to mount a dynamic component on a script tag, bypassing core dynamic component creation safeguards to execute arbitrary JavaScript within the target user&#39;s browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.</p> <p>### Attack Preconditions To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist: 1. **User-Controlled Host Selection:** The application must accept user-controlled input…</p> <p><strong>Affected:</strong> npm: @angular/core</p> <p>An issue in the `@angular/core` package allows bypassing script-execution restrictions during dynamic component creation.</p> <p>Specifically, the dynamic component instantiation mechanism (`createComponent`) failed to reject mounting components directly onto a `&lt;script&gt;` or namespaced script element (such as `&lt;svg:script&gt;`). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts.</p> <p>This flaw enables an attacker who can control the host element or selector parameter passed to `createComponent` to initialize or mount an Angular component directly onto a `&lt;script&gt;` tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS).</p> <p>### Impact Any Angular application that registers dynamic components based on user-supplied parameters (like selectors or host elements) is vulnerable to this security bypass.</p> <p>Once exploited, this allows a malicious actor to mount a dynamic component on a script tag, bypassing core dynamic component creation safeguards to execute arbitrary JavaScript within the target user&#39;s browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user.</p> <p>### Attack Preconditions To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist: 1. **User-Controlled Host Selection:** The application must accept user-controlled input…</p> https://cve.radiocsirt.org/vuln/ghsa-692r-grfm-v8x7 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-52725 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: angular.js, Ubuntu:Pro:18.04:LTS: angular.js, Ubuntu:Pro:20.04:LTS: angular.js, Ubuntu:22.04:LTS: angular.js, Ubuntu:24.04:LTS: angular.js, Ubuntu:25.10: angular.js, Ubuntu:26.04:LTS: angular.js</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a &lt;script&gt; or namespaced script element (such as &lt;svg:script&gt;). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a &lt;script&gt; tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: angular.js, Ubuntu:Pro:18.04:LTS: angular.js, Ubuntu:Pro:20.04:LTS: angular.js, Ubuntu:22.04:LTS: angular.js, Ubuntu:24.04:LTS: angular.js, Ubuntu:25.10: angular.js, Ubuntu:26.04:LTS: angular.js</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a &lt;script&gt; or namespaced script element (such as &lt;svg:script&gt;). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a &lt;script&gt; tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-52725 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1930 <p>Ein Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, einen Denial-of-Service-Zustand herbeizuführen, Daten zu manipulieren oder offenzulegen, Benutzer auf bösartige Websites umzuleiten oder Sitzungen zu kapern.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, einen Denial-of-Service-Zustand herbeizuführen, Daten zu manipulieren oder offenzulegen, Benutzer auf bösartige Websites umzuleiten oder Sitzungen zu kapern.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1930