{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:465ec911-9572-5ff5-ae97-45ceafb5fbf2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/animations", "purl": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2", "version": "17.3.12-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:6808d92a-992c-5589-9f4d-de398bb55ffa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:05929c99-f463-5ff9-b58f-bdabfed28d30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:02cd2dc5-302a-526b-86e7-76746f57c20c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:6fef3c11-4514-55a4-9231-614f119a7e5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:fc04275c-a08f-5e16-ac82-55caf6e333ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.9." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:9aabeaee-bb39-5a44-84fc-e5a3022736a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32635 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.7." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:8d7ddd57-04f6-5ae8-8732-a234b3986203", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.12." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:9585209a-6178-5382-9462-aed6a8a69db5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:6434439e-4f4d-5a94-9247-6801ce137a6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:bd726e86-de86-5bad-ba92-5d6bf113d35d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:bdc77c70-d07e-56f9-bf6d-3346d9b104a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:bccd471e-d02d-5384-a12c-670816b5339d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:9c645453-74ba-5128-96ab-6967452053c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:ece097d1-4d72-5ee6-aecf-320bd5d37317", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:e234c822-995d-5eab-a9e0-fbfc473cd6f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:b6110a84-45f9-5d0c-80bb-5ce77f292f3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:eafb85fe-7008-5507-a486-052151583052", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:90367e04-4cc3-59ff-9715-dbb01ac468a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:db4c6132-805a-5f71-a6cd-c36f31e259b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:ae3e434f-fd43-5c8a-88c9-82b84bbf41be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:79f835c9-e294-5566-9138-bef18eb518fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:e7cba087-51b6-5caa-b63e-56df44a54dc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:3468cd43-6326-5efb-8b18-4a926bb4a584", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:b462b817-6149-5638-9c56-ffe3931682f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.3.12-tuxcare.2 of @angular/animations, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:aba6c843-53a1-507f-9eb2-4c4a7f84be82", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.2 of @angular/animations. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:c5fa6437-8f9f-5ee8-b846-80c98eb23e2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.2 of @angular/animations." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:0cabca4e-b179-5057-b611-3ea3285e927a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.2 of @angular/animations." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:55e54719-bffe-5366-9bab-aa1637ae8aea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.2 of @angular/animations." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.2" } ] }