Cross-site request forgery token leakage in Angular's `@angular/common` HTTP Client lets the `X-XSRF-TOKEN` header be attached to attacker-controlled cross-origin requests when a crafted URL slips past the interceptor's absolute-URL regular expression while the browser's WHATWG URL parser resolves it to a foreign host; remote unauthenticated attackers who can influence a URL passed to a mutating request (POST/PUT/DELETE/PATCH) can capture the victim's token and later replay it for CSRF against the user's session, though user interaction and permissive CORS on the attacker server are required. Affected releases are `@angular/common` 20.0.0 through 20.3.33, 21.0.0 through 21.0.2, and 19.2.25 and earlier, while 21.0.3+, all 22.x releases, and 20.3.34 contain the WHATWG origin-comparison fix. No public exploit code or CISA KEV entry was identified at time of analysis, and the disclosure itself is an incomplete-fix follow-up to CVE-2025-66035.
An open redirect in @angular/platform-server lets remote attackers craft request URLs that make Angular's server-side rendering layer emit a 302 response with a protocol-relative Location header (`//evil.test`), sending users off-origin. Only applications actively using SSR with @angular/platform-server and @angular/ssr are affected (pure client-side SPAs are not), and the router must expose parameter/wildcard routes or pass user-controlled navigation targets such as a returnUrl. Successful exploitation requires the victim to follow the crafted link and requires the upstream reverse proxy to pass dot-segments and semicolons unnormalized; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available.
Unauthenticated SQL injection in Apache Cocoon affects all versions when a deployment uses the SQL processor or sql:/esql: logicsheets and passes attacker-controllable input into those SQL pipelines. A remote attacker who can reach such a pipeline could compromise data confidentiality, integrity, and availability, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector. The project is retired with no planned fix, no public exploit identified at time of analysis, and no CISA KEV entry; exposure is limited to instances that actually use the vulnerable SQL features and expose them to untrusted users.
XML external entity expansion in Apache Cocoon's fp: form processor lets unauthenticated remote attackers submit crafted XML that triggers server-side request forgery and can expose server files to an external system. All Cocoon versions are affected, and because the project is retired the vendor has stated it will not release a fix; exploitation requires a reachable form-processing endpoint that parses attacker-supplied XML. No public exploit identified at time of analysis, and the independent assessment rates confidentiality impact High with scope changed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).