Google Angularjs vulnerabilities

4 CVEs affecting Google Angularjs, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-11998, published 2026-06-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-11998, published 2026-06-24. High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's…
CVE-2025-0716, published 2025-04-29. Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days. Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a…
CVE-2025-2336, published 2025-06-04. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions.…
CVE-2025-4690, published 2025-08-19. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking.…