{"vulnerability": "cve-2026-8805", "sightings": [{"uuid": "ae223f20-e7eb-44b1-af3b-35993233a8cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-8805", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-05", "content": "", "creation_timestamp": "2026-06-18T05:00:00.000000Z"}, {"uuid": "a5ae8f95-4189-4697-a3d3-b415f0b1896c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8805", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3momg6mfz772q", "content": "CVE-2026-8805 - Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series EtherNet/IP module\nCVE ID : CVE-2026-8805\n \n Published : June 19, 2026, 2:26 a.m. | 42\u00a0minutes ago\n \n Description : Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubish...", "creation_timestamp": "2026-06-19T03:39:11.374891Z"}, {"uuid": "4793a0fe-d8a2-46f4-8dbb-4122b8302824", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88050", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6xqgidu57zsjh", "content": "CVE-2026-88050 - Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values\nCVE ID : CVE-2026-88050\n \n Published : Sept. 10, 2026, 5:17 p.m. | 15\u00a0minutes ago\n \n Description : Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Recod...", "creation_timestamp": "2026-09-10T18:03:55.933527Z"}, {"uuid": "df4ae80f-2c97-41be-b092-5591d0012fa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88052", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mv6qfumchu22", "content": "\ud83d\udfe0 CVE-2026-88052 - High (7.8)\n\nTesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-88052/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-10T19:01:18.637090Z"}, {"uuid": "351ef915-8eaa-4118-a373-156931d4cf17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88056", "type": "published-proof-of-concept", "source": "https://github.com/angular/angular/security/advisories/GHSA-f6mr-pjwc-34m4", "content": "", "creation_timestamp": "2026-09-10T22:35:16.534633Z"}, {"uuid": "01712079-6609-4af1-8d64-b3aa96b9013f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88056", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv6xm5stpu2f", "content": "CVE-2026-88056 - platform-server\nIf you use Angular's server-side rendering feature in versions before the latest updates, an attacker could trick the server into sending internal requests to a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#platformserver #angular #npm #CVE #infosec", "creation_timestamp": "2026-09-10T21:10:05.020530Z"}, {"uuid": "ba7b69d6-234e-4381-8133-44d668b1e30d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88058", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv7uo6hctw2j", "content": "CVE-2026-88058 - angular\nVersions of Angular before the latest updates can turn specially crafted data into active JavaScript when the server builds pages for browsers. This happens only if custom code creates\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#angular #CVE #infosec", "creation_timestamp": "2026-09-11T05:50:10.770774Z"}, {"uuid": "e9288192-7200-438a-b289-5e0014f9edc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88051", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvqkpczeel2b", "content": "\ud83d\udccc CVE-2026-88051 - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the... https://www.cyberhub.blog/cves/CVE-2026-88051", "creation_timestamp": "2026-09-17T21:07:07.345115Z"}, {"uuid": "f69bb04d-3861-4ac8-a0f6-7a3cacb60671", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88053", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvqmexbwgy25", "content": "\ud83d\udccc CVE-2026-88053 - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, N... https://www.cyberhub.blog/cves/CVE-2026-88053", "creation_timestamp": "2026-09-17T21:37:07.181017Z"}, {"uuid": "0c9e0ec5-6809-4c3a-9740-bd003fcb804a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88051", "type": "seen", "source": "https://t.me/bdufstecru/3472", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 GenericVector::read() \u0444\u0430\u0439\u043b\u0430 src/ccutil/genericvector.h \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u043f\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u043e\u0437\u043d\u0430\u0432\u0430\u043d\u0438\u044f \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 Tesseract \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-14949\nCVE-2026-88051\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/tesseract-ocr/tesseract/commit/56e09ca12e751623fe796ce1554ce704bffd2ef0\nhttps://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-88qp-4g94-3rf3\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.\nhttps://access.redhat.com/security/cve/cve-2026-88051", "creation_timestamp": "2026-09-21T15:00:03.615768Z"}, {"uuid": "de2a9001-7d07-480a-ad02-277b45efbe52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88051", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3472", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 GenericVector::read() \u0444\u0430\u0439\u043b\u0430 src/ccutil/genericvector.h \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u043f\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u043e\u0437\u043d\u0430\u0432\u0430\u043d\u0438\u044f \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 Tesseract \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-14949\nCVE-2026-88051\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/tesseract-ocr/tesseract/commit/56e09ca12e751623fe796ce1554ce704bffd2ef0\nhttps://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-88qp-4g94-3rf3\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.\nhttps://access.redhat.com/security/cve/cve-2026-88051", "creation_timestamp": "2026-09-22T00:00:09.624083Z"}, {"uuid": "53de87c2-d6f1-46a7-ac33-5490a2850a1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88058", "type": "published-proof-of-concept", "source": "https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4", "content": "", "creation_timestamp": "2026-08-27T05:45:32.000000Z"}, {"uuid": "249c8dc6-ebe6-46cd-b040-c8cf9bb955e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88058", "type": "seen", "source": "https://gist.github.com/alon710/cee061f55396c28ae35d63a44b37bd22", "content": "# CVE-2026-88058: CVE-2026-88058: Cross-Site Scripting via Server-Side Serialization Discrepancy in @angular/platform-server\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88058\n\n## Summary\nA high-severity Cross-Site Scripting (XSS) vulnerability in Angular server-side rendering (SSR) component allows unauthenticated attackers to execute arbitrary client-side JavaScript. The flaw is caused by a parsing discrepancy between the server-side DOM emulator, Domino, and standard client-side browser HTML5 parsers. When serializing ProcessingInstruction nodes inside raw-content fallback elements, Domino fails to escape matching ancestor closing tags, causing the client-side parser to transition out of raw-text mode prematurely and execute subsequent sibling elements as active HTML.\n\n## TL;DR\nAn unauthenticated attacker can achieve arbitrary JavaScript execution in a victim's browser by injecting closing tags into ProcessingInstruction nodes processed during server-side rendering, exploiting an escaping discrepancy in Angular's DOM emulator.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Base Score**: 8.6\n- **EPSS Score**: 0.00875\n- **Impact**: Arbitrary Client-Side Code Execution (XSS)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Target Component**: Domino HTML Serializer inside @angular/platform-server\n\n## Affected Systems\n\n- @angular/platform-server\n- domino\n- **@angular/platform-server**: >= 20.0.0, < 20.3.30 (Fixed in: `20.3.30`)\n- **@angular/platform-server**: >= 21.0.0, < 21.2.22 (Fixed in: `21.2.22`)\n- **@angular/platform-server**: >= 22.0.0, < 22.1.4 (Fixed in: `22.1.4`)\n- **domino**: < 2.1.7 (Fixed in: `2.1.7 (Commit 04f987dc08ff3736b427f50941adf1722458528f)`)\n\n## Mitigation\n\n- Upgrade Angular framework dependencies to patched releases incorporating the upstream Domino fix.\n- Sanitize all inputs processed by createProcessingInstruction or dynamic DOM node insertion functions on the server side.\n- Implement a strong Content Security Policy (CSP) to mitigate client-side script execution impacts.\n\n**Remediation Steps:**\n1. Identify all projects running Server-Side Rendering (SSR) with @angular/platform-server.\n2. Update package.json file to reference Angular version 20.3.30, 21.2.22, or 22.1.4 or higher.\n3. Regenerate package lock files (package-lock.json, pnpm-lock.yaml, or yarn.lock) to ensure the transitive 'domino' dependency resolves to a version containing commit 04f987dc08ff3736b427f50941adf1722458528f.\n4. Audit all uses of inject(DOCUMENT).createProcessingInstruction or Renderer2 DOM manipulation inside raw-content fallback elements like noscript or iframe.\n5. Redeploy the updated application and verify that serialized output properly escapes closing tag patterns.\n\n## References\n\n- [GitHub Security Advisory GHSA-j3r3-mxqp-r2p4](https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-88058)\n- [Angular Issue Tracking #70146](https://github.com/angular/angular/issues/70146)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-88058)\n- [Domino Patch Commit](https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f)\n- [Angular Integration Commit (v22/Main)](https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915)\n- [Angular Integration Commit (v21/v20)](https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef)\n- [Angular Release v22.1.4](https://github.com/angular/angular/releases/tag/v22.1.4)\n- [Angular Release v21.2.22](https://github.com/angular/angular/releases/tag/v21.2.22)\n- [Angular Release v20.3.30](https://github.com/angular/angular/releases/tag/v20.3.30)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88058) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T07:30:30.000000Z"}]}