Vulnerability-Lookup

CVE-2026-54268 (GCVE-0-2026-54268)

Vulnerability from cvelistv5 – Published: 2026-06-22 15:31 – Updated: 2026-06-23 16:09

Title

Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 16:07 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-1333 - Inefficient Regular Expression Complexity

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/pull/69197	x_refsource_MISC
https://github.com/angular/angular/commit/eeb03f4…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
angular	angular	Affected: >= 22.0.0-next.0 < 22.0.1 Affected: >= 21.0.0-next.0 < 21.2.17 Affected: >= 20.0.0-next.0 < 20.3.25 Affected: <= 19.2.25	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54268",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T16:07:25.833697Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T16:09:21.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0 \u003c 22.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0 \u003c 21.2.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0-next.0 \u003c 20.3.25"
            },
            {
              "status": "affected",
              "version": "\u003c= 19.2.25"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T15:31:47.836Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm"
        },
        {
          "name": "https://github.com/angular/angular/pull/69197",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/69197"
        },
        {
          "name": "https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd"
        }
      ],
      "source": {
        "advisory": "GHSA-48r7-hpm6-gfxm",
        "discovery": "UNKNOWN"
      },
      "title": "Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54268",
    "datePublished": "2026-06-22T15:31:47.836Z",
    "dateReserved": "2026-06-12T17:13:32.279Z",
    "dateUpdated": "2026-06-23T16:09:21.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54268",
      "date": "2026-09-21",
      "epss": "0.00583",
      "percentile": "0.46317"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "angular",
                "vendor": "angular",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 22.0.0-next.0 \u003c 22.0.1"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 21.0.0-next.0 \u003c 21.2.17"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 20.0.0-next.0 \u003c 20.3.25"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c= 19.2.25"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "D511E6AD-81F0-4D1B-9714-5F11AFCBE18E",
                    "versionEndIncluding": "19.2.25",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "A07B48E8-DEB0-4AFF-8E73-C3B05DC10AC1",
                    "versionEndExcluding": "20.3.25",
                    "versionStartIncluding": "20.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "719E82E9-3914-484D-BEBF-A89AF5049B83",
                    "versionEndExcluding": "21.2.17",
                    "versionStartIncluding": "21.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "F8388A42-0154-438C-A3BF-A8E980CE0C9E",
                    "versionEndExcluding": "22.0.1",
                    "versionStartIncluding": "22.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25."
          }
        ],
        "id": "CVE-2026-54268",
        "lastModified": "2026-07-09T15:39:41.960",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54268",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T16:07:25.833697Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-22T16:16:39.590",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/angular/angular/pull/69197"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              },
              {
                "lang": "en",
                "value": "CWE-1333"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-15T15:41:21+00:00",
      "cve": "CVE-2026-54268",
      "id": "CVE-2026-54268",
      "initial_release_date": "2026-06-22T15:31:47.836000+00:00",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "81",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "@angular/common: Angular @angular/common: Denial of Service via crafted date format string",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54268.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54268",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-23T16:07:25.833697Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-23T16:07:31.436Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "angular",
              "vendor": "angular",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 22.0.0-next.0 \u003c 22.0.1"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 21.0.0-next.0 \u003c 21.2.17"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 20.0.0-next.0 \u003c 20.3.25"
                },
                {
                  "status": "affected",
                  "version": "\u003c= 19.2.25"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-400",
                  "description": "CWE-400: Uncontrolled Resource Consumption",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-1333",
                  "description": "CWE-1333: Inefficient Regular Expression Complexity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-22T15:31:47.836Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm"
            },
            {
              "name": "https://github.com/angular/angular/pull/69197",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/angular/angular/pull/69197"
            },
            {
              "name": "https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd"
            }
          ],
          "source": {
            "advisory": "GHSA-48r7-hpm6-gfxm",
            "discovery": "UNKNOWN"
          },
          "title": "Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54268",
        "datePublished": "2026-06-22T15:31:47.836Z",
        "dateReserved": "2026-06-12T17:13:32.279Z",
        "dateUpdated": "2026-06-23T16:09:21.239Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0933

Vulnerability from certfr_avis - Published: 2026-07-24 - Updated: 2026-07-24

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
IBM	QRadar Assistant	QRadar AI Assistant versions antérieures à 2.1.0
IBM	Sterling	Sterling B2B Integrator et Sterling File Gateway versions 6.2.2.x antérieures à 6.2.2.1
IBM	Sterling	Sterling B2B Integrator et Sterling File Gateway versions 6.2.1.x antérieures à 6.2.1.2
IBM	QRadar SIEM	QRadar SIEM versions 7.5.x antérieures à 7.5.0 UP15 IF05
IBM	Sterling	Sterling Connect:Direct Web Services versions 6.4.x antérieures à 6.4.0.9
IBM	Tivoli	Tivoli System Automation Application Manager 4.1 avec WebSphere Application Server versions 8.5 ou 9.0 sans les derniers correctifs de sécurité
IBM	Cognos Command Center	Cognos Command Center versions 12.2.4.1 à 12.2.5 FP1 IF3 antérieures à 12.2.5 FP1 IF4
IBM	AIX	AIX versions 7.2 et 7.3 sans le dernier correctif de sécurité
IBM	Sterling	Sterling Connect:Direct Web Services versions 6.3.x antérieures à 6.3.0.20
IBM	Sterling	Sterling B2B Integrator et Sterling File Gateway versions 6.2.0.x antérieures à 6.2.0.6_1
IBM	WebSphere	WebSphere Application Server - Liberty versions 17.0.0.3 à 26.0.0.7 sans les correctifs de sécurité temporaires PH71839 et PH72167 ou antérieures à 26.0.0.8 (disponibilité prévue pour le troisième trimestre 2026)
IBM	Tivoli	Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent version 7.3.0 Fix Pack 4 sans le dernier correctif pour Tivoli Monitoring
IBM	VIOS	VIOS version 4.1 sans le dernier correctif de sécurité
IBM	Sterling	Sterling B2B Integrator et Sterling File Gateway versions 6.1.2.x antérieures à 6.1.2.8
IBM	Tivoli	Tivoli Application Dependency Discovery Manager versions 7.3.0.0 à 7.3.0.12 avec WebSphere Application Server Liberty versions antérieures à 26.0.0.7

References

Title

Publication Time

Tags

Bulletin de sécurité IBM 7280728	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7280784	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7280667	2026-07-21	vendor-advisory
Bulletin de sécurité IBM 7280663	2026-07-21	vendor-advisory
Bulletin de sécurité IBM 7280907	2026-07-23	vendor-advisory
Bulletin de sécurité IBM 7280731	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7280720	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7281073	2026-07-24	vendor-advisory
Bulletin de sécurité IBM 7280519	2026-07-20	vendor-advisory
Bulletin de sécurité IBM 7280540	2026-07-20	vendor-advisory
Bulletin de sécurité IBM 7280730	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7280726	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7280783	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7280650	2026-07-21	vendor-advisory
Bulletin de sécurité IBM 7280654	2026-07-21	vendor-advisory
Bulletin de sécurité IBM 7280644	2026-07-21	vendor-advisory
Bulletin de sécurité IBM 7280729	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7280785	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7280695	2026-07-21	vendor-advisory
Bulletin de sécurité IBM 7280719	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7280727	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7280646	2026-07-21	vendor-advisory
Bulletin de sécurité IBM 7280670	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7280916	2026-07-23	vendor-advisory
Bulletin de sécurité IBM 7280950	2026-07-23	vendor-advisory
Bulletin de sécurité IBM 7280126	2026-07-21	vendor-advisory
Bulletin de sécurité IBM 7280656	2026-07-21	vendor-advisory
Bulletin de sécurité IBM 7280621	2026-07-22	vendor-advisory
Bulletin de sécurité IBM 7280887	2026-07-23	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QRadar AI Assistant versions ant\u00e9rieures \u00e0 2.1.0",
      "product": {
        "name": "QRadar Assistant",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling B2B Integrator et Sterling File Gateway versions 6.2.2.x ant\u00e9rieures \u00e0 6.2.2.1",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling B2B Integrator et Sterling File Gateway versions 6.2.1.x ant\u00e9rieures \u00e0 6.2.1.2",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar SIEM versions 7.5.x ant\u00e9rieures \u00e0 7.5.0 UP15 IF05",
      "product": {
        "name": "QRadar SIEM",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect:Direct Web Services versions 6.4.x ant\u00e9rieures \u00e0 6.4.0.9",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Tivoli System Automation Application Manager 4.1 avec WebSphere Application Server versions 8.5 ou 9.0 sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Command Center versions 12.2.4.1 \u00e0 12.2.5 FP1 IF3 ant\u00e9rieures \u00e0 12.2.5 FP1 IF4",
      "product": {
        "name": "Cognos Command Center",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "AIX versions 7.2 et 7.3 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "AIX",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect:Direct Web Services versions 6.3.x ant\u00e9rieures \u00e0 6.3.0.20",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling B2B Integrator et Sterling File Gateway versions 6.2.0.x ant\u00e9rieures \u00e0 6.2.0.6_1",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server - Liberty versions 17.0.0.3 \u00e0 26.0.0.7 sans les correctifs de s\u00e9curit\u00e9 temporaires PH71839 et PH72167 ou ant\u00e9rieures \u00e0 26.0.0.8 (disponibilit\u00e9 pr\u00e9vue pour le troisi\u00e8me trimestre 2026)",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent version 7.3.0 Fix Pack 4 sans le dernier correctif pour Tivoli Monitoring",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "VIOS version 4.1 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "VIOS",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling B2B Integrator et Sterling File Gateway versions 6.1.2.x ant\u00e9rieures \u00e0 6.1.2.8",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Tivoli Application Dependency Discovery Manager versions 7.3.0.0 \u00e0 7.3.0.12 avec WebSphere Application Server Liberty versions ant\u00e9rieures \u00e0 26.0.0.7",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-53540",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53540"
    },
    {
      "name": "CVE-2026-54283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54283"
    },
    {
      "name": "CVE-2026-50557",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50557"
    },
    {
      "name": "CVE-2026-33871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
    },
    {
      "name": "CVE-2026-48990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48990"
    },
    {
      "name": "CVE-2026-11383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11383"
    },
    {
      "name": "CVE-2026-34180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34180"
    },
    {
      "name": "CVE-2026-45416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45416"
    },
    {
      "name": "CVE-2026-42766",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42766"
    },
    {
      "name": "CVE-2026-9076",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9076"
    },
    {
      "name": "CVE-2026-42211",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42211"
    },
    {
      "name": "CVE-2026-54530",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54530"
    },
    {
      "name": "CVE-2026-54514",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54514"
    },
    {
      "name": "CVE-2021-23336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23336"
    },
    {
      "name": "CVE-2026-48710",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"
    },
    {
      "name": "CVE-2026-42770",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42770"
    },
    {
      "name": "CVE-2026-24308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24308"
    },
    {
      "name": "CVE-2026-45673",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45673"
    },
    {
      "name": "CVE-2026-9072",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9072"
    },
    {
      "name": "CVE-2026-54275",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54275"
    },
    {
      "name": "CVE-2026-32635",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32635"
    },
    {
      "name": "CVE-2026-27171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27171"
    },
    {
      "name": "CVE-2026-45445",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45445"
    },
    {
      "name": "CVE-2026-29145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29145"
    },
    {
      "name": "CVE-2026-8858",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8858"
    },
    {
      "name": "CVE-2026-54651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54651"
    },
    {
      "name": "CVE-2026-54278",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54278"
    },
    {
      "name": "CVE-2026-54516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54516"
    },
    {
      "name": "CVE-2026-53538",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53538"
    },
    {
      "name": "CVE-2026-2006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2006"
    },
    {
      "name": "CVE-2026-54515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54515"
    },
    {
      "name": "CVE-2026-33245",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33245"
    },
    {
      "name": "CVE-2026-33870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
    },
    {
      "name": "CVE-2025-5115",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5115"
    },
    {
      "name": "CVE-2021-47154",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47154"
    },
    {
      "name": "CVE-2026-11541",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11541"
    },
    {
      "name": "CVE-2026-11707",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11707"
    },
    {
      "name": "CVE-2026-2005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2005"
    },
    {
      "name": "CVE-2026-7383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7383"
    },
    {
      "name": "CVE-2026-48522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48522"
    },
    {
      "name": "CVE-2026-45674",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45674"
    },
    {
      "name": "CVE-2026-34500",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34500"
    },
    {
      "name": "CVE-2026-11594",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11594"
    },
    {
      "name": "CVE-2026-54267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54267"
    },
    {
      "name": "CVE-2026-29146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29146"
    },
    {
      "name": "CVE-2026-48735",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48735"
    },
    {
      "name": "CVE-2026-15057",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15057"
    },
    {
      "name": "CVE-2026-45409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45409"
    },
    {
      "name": "CVE-2026-47265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47265"
    },
    {
      "name": "CVE-2026-54282",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54282"
    },
    {
      "name": "CVE-2026-44249",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44249"
    },
    {
      "name": "CVE-2026-41844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41844"
    },
    {
      "name": "CVE-2026-48988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48988"
    },
    {
      "name": "CVE-2026-54268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54268"
    },
    {
      "name": "CVE-2026-5598",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5598"
    },
    {
      "name": "CVE-2026-54277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54277"
    },
    {
      "name": "CVE-2026-41842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41842"
    },
    {
      "name": "CVE-2026-11536",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11536"
    },
    {
      "name": "CVE-2026-8646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8646"
    },
    {
      "name": "CVE-2026-54280",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54280"
    },
    {
      "name": "CVE-2026-27970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27970"
    },
    {
      "name": "CVE-2026-9320",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9320"
    },
    {
      "name": "CVE-2026-54265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54265"
    },
    {
      "name": "CVE-2025-68161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68161"
    },
    {
      "name": "CVE-2026-50171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50171"
    },
    {
      "name": "CVE-2026-45447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45447"
    },
    {
      "name": "CVE-2026-22731",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22731"
    },
    {
      "name": "CVE-2026-41843",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41843"
    },
    {
      "name": "CVE-2026-22732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22732"
    },
    {
      "name": "CVE-2026-40181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40181"
    },
    {
      "name": "CVE-2026-54274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54274"
    },
    {
      "name": "CVE-2026-34487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34487"
    },
    {
      "name": "CVE-2026-54512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
    },
    {
      "name": "CVE-2026-41850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41850"
    },
    {
      "name": "CVE-2026-34197",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34197"
    },
    {
      "name": "CVE-2026-33244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33244"
    },
    {
      "name": "CVE-2026-54266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54266"
    },
    {
      "name": "CVE-2026-45446",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45446"
    },
    {
      "name": "CVE-2026-40198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40198"
    },
    {
      "name": "CVE-2026-53537",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53537"
    },
    {
      "name": "CVE-2026-4176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4176"
    },
    {
      "name": "CVE-2026-48524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48524"
    },
    {
      "name": "CVE-2026-40046",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40046"
    },
    {
      "name": "CVE-2026-52725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-52725"
    },
    {
      "name": "CVE-2026-54273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54273"
    },
    {
      "name": "CVE-2025-64775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-64775"
    },
    {
      "name": "CVE-2026-41852",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41852"
    },
    {
      "name": "CVE-2026-27830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27830"
    },
    {
      "name": "CVE-2026-11897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11897"
    },
    {
      "name": "CVE-2026-25854",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25854"
    },
    {
      "name": "CVE-2026-54531",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54531"
    },
    {
      "name": "CVE-2026-48155",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48155"
    },
    {
      "name": "CVE-2026-41851",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41851"
    },
    {
      "name": "CVE-2026-50010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50010"
    },
    {
      "name": "CVE-2026-54279",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54279"
    },
    {
      "name": "CVE-2026-42767",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42767"
    },
    {
      "name": "CVE-2026-3381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-3381"
    },
    {
      "name": "CVE-2026-22733",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22733"
    },
    {
      "name": "CVE-2026-41841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41841"
    },
    {
      "name": "CVE-2026-39304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39304"
    },
    {
      "name": "CVE-2026-54517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54517"
    },
    {
      "name": "CVE-2026-50170",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50170"
    },
    {
      "name": "CVE-2026-41846",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41846"
    },
    {
      "name": "CVE-2026-40199",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40199"
    },
    {
      "name": "CVE-2026-54513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54513"
    },
    {
      "name": "CVE-2026-54518",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54518"
    },
    {
      "name": "CVE-2026-54276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54276"
    },
    {
      "name": "CVE-2025-66566",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66566"
    },
    {
      "name": "CVE-2025-66168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66168"
    },
    {
      "name": "CVE-2026-42342",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42342"
    },
    {
      "name": "CVE-2026-12143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12143"
    },
    {
      "name": "CVE-2026-48523",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48523"
    },
    {
      "name": "CVE-2024-3651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3651"
    },
    {
      "name": "CVE-2025-66675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66675"
    },
    {
      "name": "CVE-2026-33227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33227"
    },
    {
      "name": "CVE-2026-34483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34483"
    },
    {
      "name": "CVE-2026-34182",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34182"
    },
    {
      "name": "CVE-2026-0636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
    },
    {
      "name": "CVE-2026-47691",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47691"
    },
    {
      "name": "CVE-2026-24880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24880"
    },
    {
      "name": "CVE-2026-48525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48525"
    },
    {
      "name": "CVE-2026-2004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2004"
    },
    {
      "name": "CVE-2026-9071",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9071"
    },
    {
      "name": "CVE-2026-35554",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35554"
    },
    {
      "name": "CVE-2026-34993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34993"
    },
    {
      "name": "CVE-2026-27727",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27727"
    },
    {
      "name": "CVE-2026-10852",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10852"
    },
    {
      "name": "CVE-2025-12183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-12183"
    },
    {
      "name": "CVE-2026-41848",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41848"
    },
    {
      "name": "CVE-2025-14813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
    },
    {
      "name": "CVE-2026-48156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48156"
    },
    {
      "name": "CVE-2026-24281",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24281"
    },
    {
      "name": "CVE-2026-34077",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34077"
    },
    {
      "name": "CVE-2026-53539",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53539"
    },
    {
      "name": "CVE-2025-11226",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-11226"
    }
  ],
  "initial_release_date": "2026-07-24T00:00:00",
  "last_revision_date": "2026-07-24T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0933",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-07-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280728",
      "url": "https://www.ibm.com/support/pages/node/7280728"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280784",
      "url": "https://www.ibm.com/support/pages/node/7280784"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280667",
      "url": "https://www.ibm.com/support/pages/node/7280667"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280663",
      "url": "https://www.ibm.com/support/pages/node/7280663"
    },
    {
      "published_at": "2026-07-23",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280907",
      "url": "https://www.ibm.com/support/pages/node/7280907"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280731",
      "url": "https://www.ibm.com/support/pages/node/7280731"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280720",
      "url": "https://www.ibm.com/support/pages/node/7280720"
    },
    {
      "published_at": "2026-07-24",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7281073",
      "url": "https://www.ibm.com/support/pages/node/7281073"
    },
    {
      "published_at": "2026-07-20",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280519",
      "url": "https://www.ibm.com/support/pages/node/7280519"
    },
    {
      "published_at": "2026-07-20",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280540",
      "url": "https://www.ibm.com/support/pages/node/7280540"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280730",
      "url": "https://www.ibm.com/support/pages/node/7280730"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280726",
      "url": "https://www.ibm.com/support/pages/node/7280726"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280783",
      "url": "https://www.ibm.com/support/pages/node/7280783"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280650",
      "url": "https://www.ibm.com/support/pages/node/7280650"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280654",
      "url": "https://www.ibm.com/support/pages/node/7280654"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280644",
      "url": "https://www.ibm.com/support/pages/node/7280644"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280729",
      "url": "https://www.ibm.com/support/pages/node/7280729"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280785",
      "url": "https://www.ibm.com/support/pages/node/7280785"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280695",
      "url": "https://www.ibm.com/support/pages/node/7280695"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280719",
      "url": "https://www.ibm.com/support/pages/node/7280719"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280727",
      "url": "https://www.ibm.com/support/pages/node/7280727"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280646",
      "url": "https://www.ibm.com/support/pages/node/7280646"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280670",
      "url": "https://www.ibm.com/support/pages/node/7280670"
    },
    {
      "published_at": "2026-07-23",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280916",
      "url": "https://www.ibm.com/support/pages/node/7280916"
    },
    {
      "published_at": "2026-07-23",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280950",
      "url": "https://www.ibm.com/support/pages/node/7280950"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280126",
      "url": "https://www.ibm.com/support/pages/node/7280126"
    },
    {
      "published_at": "2026-07-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280656",
      "url": "https://www.ibm.com/support/pages/node/7280656"
    },
    {
      "published_at": "2026-07-22",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280621",
      "url": "https://www.ibm.com/support/pages/node/7280621"
    },
    {
      "published_at": "2026-07-23",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7280887",
      "url": "https://www.ibm.com/support/pages/node/7280887"
    }
  ]
}

FKIE_CVE-2026-54268

Vulnerability from fkie_nvd - Published: 2026-06-22 16:16 - Updated: 2026-07-09 15:39

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd	Patch
security-advisories@github.com	https://github.com/angular/angular/pull/69197	Issue Tracking, Patch
security-advisories@github.com	https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm	Vendor Advisory

Impacted products

Vendor	Product	Version
angular	angular	*
angular	angular	*
angular	angular	*
angular	angular	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0 \u003c 22.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0-next.0 \u003c 21.2.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0-next.0 \u003c 20.3.25"
            },
            {
              "status": "affected",
              "version": "\u003c= 19.2.25"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "D511E6AD-81F0-4D1B-9714-5F11AFCBE18E",
              "versionEndIncluding": "19.2.25",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "A07B48E8-DEB0-4AFF-8E73-C3B05DC10AC1",
              "versionEndExcluding": "20.3.25",
              "versionStartIncluding": "20.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "719E82E9-3914-484D-BEBF-A89AF5049B83",
              "versionEndExcluding": "21.2.17",
              "versionStartIncluding": "21.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "F8388A42-0154-438C-A3BF-A8E980CE0C9E",
              "versionEndExcluding": "22.0.1",
              "versionStartIncluding": "22.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25."
    }
  ],
  "id": "CVE-2026-54268",
  "lastModified": "2026-07-09T15:39:41.960",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54268",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-23T16:07:25.833697Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-22T16:16:39.590",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/angular/angular/pull/69197"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-48R7-HPM6-GFXM

Vulnerability from github – Published: 2026-06-15 17:24 – Updated: 2026-07-15 22:04

Summary

@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

Details

A Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter.

When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS).

Impact

1. Server-Side Rendering (SSR)

In Angular applications that leverage Server-Side Rendering, an attacker can supply a malicious payload with an excessively long date format string. Processing this on the server causes high CPU usage and triggers a JavaScript heap out of memory crash, rendering the application unavailable to all users.

2. Client-Side Rendering (CSR)

In standard client-side applications, executing the vulnerable function with an excessively long format string blocks the browser's main thread, causing the browser tab to freeze and become completely unresponsive.

Patched Versions

22.0.1
21.2.17
20.3.25

Attack Preconditions

For this vulnerability to be exploitable, both of the following conditions must be met: 1. Vulnerable Component Usage: The application must format dates using the formatDate utility or the DatePipe. 2. Attacker-Controlled Parameter: The date format string passed to these utilities must be customizable or directly controlled by untrusted user input (e.g., parsed from query parameters, user preferences, or API responses).

If the date format is hardcoded (e.g., 'mediumDate', 'shortTime', or static strings) or properly validated to be within a reasonable length limit, the application is not vulnerable.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "22.0.0-next.0"
            },
            {
              "fixed": "22.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "21.0.0-next.0"
            },
            {
              "fixed": "21.2.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "20.0.0-next.0"
            },
            {
              "fixed": "20.3.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "19.2.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54268"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-15T17:24:52Z",
    "nvd_published_at": "2026-06-22T16:16:39Z",
    "severity": "HIGH"
  },
  "details": "A Denial of Service (DoS) vulnerability exists in the `@angular/common` package of the Angular framework. The `formatDate` function, which is also utilized by the standard Angular `DatePipe`, does not properly limit or validate the length of the `format` parameter. \n\nWhen parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS).\n\n\n### Impact\n\n#### 1. Server-Side Rendering (SSR)\nIn Angular applications that leverage Server-Side Rendering, an attacker can supply a malicious payload with an excessively long date format string. Processing this on the server causes high CPU usage and triggers a `JavaScript heap out of memory` crash, rendering the application unavailable to all users.\n\n#### 2. Client-Side Rendering (CSR)\nIn standard client-side applications, executing the vulnerable function with an excessively long format string blocks the browser\u0027s main thread, causing the browser tab to freeze and become completely unresponsive.\n\n### Patched Versions\n* 22.0.1  \n* 21.2.17  \n* 20.3.25\n\n### Attack Preconditions\nFor this vulnerability to be exploitable, both of the following conditions must be met:\n1. **Vulnerable Component Usage:** The application must format dates using the `formatDate` utility or the `DatePipe`.\n2. **Attacker-Controlled Parameter:** The date format string passed to these utilities must be customizable or directly controlled by untrusted user input (e.g., parsed from query parameters, user preferences, or API responses).\n\n*If the date format is hardcoded (e.g., `\u0027mediumDate\u0027`, `\u0027shortTime\u0027`, or static strings) or properly validated to be within a reasonable length limit, the application is not vulnerable.*",
  "id": "GHSA-48r7-hpm6-gfxm",
  "modified": "2026-07-15T22:04:14Z",
  "published": "2026-06-15T17:24:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/security/advisories/GHSA-48r7-hpm6-gfxm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54268"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/pull/69197"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/commit/eeb03f4ea310e2e51ba5d53a421ec7b418e186cd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/angular/angular"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)"
}

UBUNTU-CVE-2026-54268 (CVE-2026-54268)

Vulnerability from osv_ubuntu – Published: 2026-06-22 16:16 – Updated: 2026-06-29 11:36 – Source website

Details

Severity

8.2 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-54268	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-54268	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.2.28-1ubuntu2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.2.28-1ubuntu2+esm1?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.28-1ubuntu2",
        "1.2.28-1ubuntu2+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.5.10-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.5.10-1ubuntu0.1~esm1?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.10-1",
        "1.5.10-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.7.9-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.7.9-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.10-1",
        "1.7.9-1",
        "1.7.9-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.2-2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.2-2ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.2-2",
        "1.8.2-2ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.3-1ubuntu0.24.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.3-1ubuntu0.24.04.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-1",
        "1.8.3-1ubuntu0.24.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.3-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.3-3?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-1",
        "1.8.3-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.3-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.3-3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-3"
      ]
    }
  ],
  "aliases": [],
  "details": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.",
  "id": "UBUNTU-CVE-2026-54268",
  "modified": "2026-06-29T11:36:36Z",
  "published": "2026-06-22T16:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-54268"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54268"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-54268"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54268 (GCVE-0-2026-54268)

CERTFR-2026-AVI-0933

Solutions

FKIE_CVE-2026-54268

GHSA-48R7-HPM6-GFXM

Impact

1. Server-Side Rendering (SSR)

2. Client-Side Rendering (CSR)

Patched Versions

Attack Preconditions

UBUNTU-CVE-2026-54268 (CVE-2026-54268)

Tags

Sightings

Nomenclature

Related by attack behaviour