CVE-2026-68945

MediumCVSS 6.1/10Last modified Aug 11, 2026

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published
Aug 3, 2026
Last modified
Aug 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-68958.8The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege EsCVE-2026-689508.8The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file CVE-2026-689516.9GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the CVE-2026-689536.5The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device iCVE-2026-689549.0The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnCVE-2026-689558.4The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. If there is a crafted DLL at tCVE-2026-689567.1Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust nodeCVE-2026-689574.3Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository oCVE-2026-689595.8SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can logCVE-2026-68965.4GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 thaCVE-2026-689605.8A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacCVE-2026-689644.3Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can