CVE-2025-66035Published

Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs

cve-program · CVE-2025-66035

Published

angular

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "angular",
                    "product": "angular",
                    "versions": [
                        {
                            "version": ">= 21.0.0-next.0, < 21.0.1",
                            "status": "affected"
                        },
                        {
                            "version": ">= 20.0.0-next.0, < 20.3.14",
                            "status": "affected"
                        },
                        {
                            "version": "< 19.2.16",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2025-199769

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Nov 26, 2025, 10:18:35 PM

dateUpdated: Jun 2, 2026, 1:00:29 PM

6 related source bulletins · separate from aliases

SSA-253495: SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0

CVE-2025-1352 · CVE-2025-1376 · CVE-2025-6052 · CVE-2025-6141 · CVE-2025-6170 · CVE-2025-7039 · CVE-2025-8732 · CVE-2025-9086 · CVE-2025-9230 · CVE-2025-9231 · CVE-2025-9232 · CVE-2025-10966 · CVE-2025-13465 · CVE-2025-13601 · CVE-2025-39913 · CVE-2025-40214 · CVE-2025-40248 · CVE-2025-40250 · CVE-2025-40251 · CVE-2025-40252 · CVE-2025-40254 · CVE-2025-40257 · CVE-2025-40258 · CVE-2025-40261 · CVE-2025-40262 · CVE-2025-40263 · CVE-2025-40264 · CVE-2025-40271 · CVE-2025-40278 · CVE-2025-40280 · CVE-2025-40281 · CVE-2025-40345 · CVE-2025-46394 · CVE-2025-49794 · CVE-2025-49795 · CVE-2025-49796 · CVE-2025-60876 · CVE-2025-66035 · CVE-2025-66382 · CVE-2025-66412 · CVE-2025-69720 · CVE-2025-71185 · CVE-2025-71186 · CVE-2025-71188 · CVE-2025-71189 · CVE-2025-71190 · CVE-2025-71191 · CVE-2026-1484 · CVE-2026-1489 · CVE-2026-3784 · CVE-2026-22610 · CVE-2026-22976 · CVE-2026-22977 · CVE-2026-23025 · CVE-2026-23026 · CVE-2026-23030 · CVE-2026-23031 · CVE-2026-23032 · CVE-2026-23033 · CVE-2026-23037 · CVE-2026-23038 · CVE-2026-23111 · CVE-2026-23112 · CVE-2026-23220 · CVE-2026-23222 · CVE-2026-23228 · CVE-2026-23229 · CVE-2026-23230 · CVE-2026-23231 · CVE-2026-23236 · CVE-2026-23238 · CVE-2026-24515 · CVE-2026-25210 · CVE-2026-26157 · CVE-2026-26158 · CVE-2026-35535 · CVE-2026-41918

ICSA-26-188-05: Siemens SINEC OS

ICSA-26-071-03: Siemens SIDIS Prime

NCSC-2026-0079: Kwetsbaarheden verholpen in Siemens producten

CVE-2024-29857 · CVE-2024-30171 · CVE-2024-30172 · CVE-2024-41996 · CVE-2025-6965 · CVE-2025-7783 · CVE-2025-9230 · CVE-2025-9232 · CVE-2025-9670 · CVE-2025-12816 · CVE-2025-15284 · CVE-2025-27769 · CVE-2025-40943 · CVE-2025-55018 · CVE-2025-58751 · CVE-2025-58752 · CVE-2025-58754 · CVE-2025-62439 · CVE-2025-62522 · CVE-2025-64157 · CVE-2025-64718 · CVE-2025-64756 · CVE-2025-66030 · CVE-2025-66031 · CVE-2025-66035 · CVE-2025-66412 · CVE-2025-69277 · CVE-2026-22610 · CVE-2026-24858 · CVE-2026-25569 · CVE-2026-25570 · CVE-2026-25571 · CVE-2026-25572 · CVE-2026-25573 · CVE-2026-25605

RHSA-2026:86618: Red Hat Security Advisory: New container image: rhceph-9.2

CVE-2023-46159 · CVE-2024-47866 · CVE-2024-48916 · CVE-2024-55565 · CVE-2025-12816 · CVE-2025-15599 · CVE-2025-26791 · CVE-2025-30156 · CVE-2025-50181 · CVE-2025-50182 · CVE-2025-58754 · CVE-2025-59343 · CVE-2025-62718 · CVE-2025-66030 · CVE-2025-66035 · CVE-2025-66412 · CVE-2025-69873 · CVE-2026-0540 · CVE-2026-21441 · CVE-2026-22610 · CVE-2026-25639 · CVE-2026-26996 · CVE-2026-27903 · CVE-2026-27904 · CVE-2026-27970 · CVE-2026-32141 · CVE-2026-33228 · CVE-2026-33671 · CVE-2026-33672 · CVE-2026-33891 · CVE-2026-33894 · CVE-2026-33895 · CVE-2026-33896 · CVE-2026-39865 · CVE-2026-40175 · CVE-2026-40895 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-41305 · CVE-2026-42033 · CVE-2026-42034 · CVE-2026-42035 · CVE-2026-42036 · CVE-2026-42037 · CVE-2026-42038 · CVE-2026-42039 · CVE-2026-42040 · CVE-2026-42041 · CVE-2026-42042 · CVE-2026-42043 · CVE-2026-42044 · CVE-2026-50152 · CVE-2026-58224

SSA-485750: SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-66035

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-201 · CWE-359

Original publisher date fields

published: 2025-11-26T23:15:49.550

lastModified: 2026-10-19T13:10:00.110

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-58c5-g7wp-6w37

Published

@angular/common

npm

SEMVER · introduced 21.0.0-next.0 → fixed 21.0.1

@angular/common

npm

SEMVER · introduced 20.0.0-next.0 → fixed 20.3.14

@angular/common

npm

SEMVER · introduced 0 → fixed 19.2.16

Original source record · Cite this exact observation · Complete original publisher JSON