https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:36:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-366937 EUVD-2026-366937 https://cve.radiocsirt.org/vuln/euvd-2026-366937 https://cve.radiocsirt.org/vuln/fkie_cve-2026-88059 <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular&#39;s @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user&#39;s sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular&#39;s @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user&#39;s sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-88059 https://cve.radiocsirt.org/vuln/ghsa-p297-fm68-3q8c <p><strong>Affected:</strong> npm: @angular/common</p> <p>A security bypass vulnerability was discovered in `@angular/common` when Server-Side Rendering (SSR) and hydration are enabled in applications using a hierarchical `HttpClient` configuration with `withRequestsMadeViaParent()`.</p> <p>The `HttpTransferCache` utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via `TransferState` (serialized as JSON in `&lt;script id=&#34;ng-state&#34;&gt;`). Following the remediation of [CVE-2026-50170](https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x), `HttpTransferCache` automatically skips caching requests that contain authentication headers or credentials (`Authorization`, `Cookie`, `withCredentials`, etc.).</p> <p>However, when a child `HttpClient` delegates to a parent client via `withRequestsMadeViaParent()`, the child&#39;s `TransferCache` interceptor evaluates whether the request is eligible for caching **before** delegating to the parent client&#39;s interceptor chain.</p> <p>If an outgoing request originates as anonymous from the child client, the child `TransferCache` marks the request as cacheable. When the request reaches a parent interceptor that injects sensitive authentication credentials (such as an `Authorization` header or API token), the parent `TransferCache` correctly skips caching the authenticated request. However, when the backend returns the private, authenticated response, the child `TransferCache` still stores the response in `Trans…</p> <p><strong>Affected:</strong> npm: @angular/common</p> <p>A security bypass vulnerability was discovered in `@angular/common` when Server-Side Rendering (SSR) and hydration are enabled in applications using a hierarchical `HttpClient` configuration with `withRequestsMadeViaParent()`.</p> <p>The `HttpTransferCache` utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via `TransferState` (serialized as JSON in `&lt;script id=&#34;ng-state&#34;&gt;`). Following the remediation of [CVE-2026-50170](https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x), `HttpTransferCache` automatically skips caching requests that contain authentication headers or credentials (`Authorization`, `Cookie`, `withCredentials`, etc.).</p> <p>However, when a child `HttpClient` delegates to a parent client via `withRequestsMadeViaParent()`, the child&#39;s `TransferCache` interceptor evaluates whether the request is eligible for caching **before** delegating to the parent client&#39;s interceptor chain.</p> <p>If an outgoing request originates as anonymous from the child client, the child `TransferCache` marks the request as cacheable. When the request reaches a parent interceptor that injects sensitive authentication credentials (such as an `Authorization` header or API token), the parent `TransferCache` correctly skips caching the authenticated request. However, when the backend returns the private, authenticated response, the child `TransferCache` still stores the response in `Trans…</p> https://cve.radiocsirt.org/vuln/ghsa-p297-fm68-3q8c https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-88059 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: angular.js, Ubuntu:Pro:18.04:LTS: angular.js, Ubuntu:Pro:20.04:LTS: angular.js, Ubuntu:22.04:LTS: angular.js, Ubuntu:24.04:LTS: angular.js, Ubuntu:26.04:LTS: angular.js</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular&#39;s @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user&#39;s sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: angular.js, Ubuntu:Pro:18.04:LTS: angular.js, Ubuntu:Pro:20.04:LTS: angular.js, Ubuntu:22.04:LTS: angular.js, Ubuntu:24.04:LTS: angular.js, Ubuntu:26.04:LTS: angular.js</p> <p>Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular&#39;s @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user&#39;s sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-88059 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3318 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren und offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Angular ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren und offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3318