{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:317f33c3-8e25-5a09-bc91-3e98995da4f6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/animations", "purl": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5", "version": "17.3.12-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:c1f6f938-2603-5088-95d4-c1a87f682af3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.5 of @angular/animations." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:ebbdf307-da90-5f09-9f90-5848ccd894d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.5 of @angular/animations." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:b1d5d63a-962a-569d-bcb5-d46bea9a3d13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.5 of @angular/animations." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:935005e0-0932-535a-bc0d-59670f4679a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.5 of @angular/animations." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:0978869e-f0ca-53c2-b7ed-911a3afdffac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.9." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:0945c892-d563-5f89-adfe-84830b8e32c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32635 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.7." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:27d8c7ba-4586-5547-99fe-5699b366ccfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.12." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:413c0d8a-f8f3-57a8-8673-db123d62f66a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:f9bd9982-5668-5a34-8d47-95371a3e37a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:d983001f-67d4-55fe-b6b6-6e3300d5ee09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:286ecbd2-ea44-5c7d-928c-5f8e825e7d59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:ba6455b4-77b5-5079-80f5-a24056c197f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:65395bd0-1918-5ff5-af07-4e155b439d40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:c2df1a63-444b-5457-8ab2-69394ed03be6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:a513edb0-ec2a-5b79-8943-2bfcac6c33e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:1e2d256e-874a-5d71-b8ca-00b5fb5344f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:8faed36f-b1f9-5df7-8069-e49e8b3199de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:34685842-c541-5637-b2b9-77c7594edc71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:07f689bf-1b8e-59a5-96df-94ffe942dbcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:5cb7f370-6f85-5967-ba57-78eef27c3111", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:fc0952c9-234b-5947-9a52-7d1d15b6e4fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:6006cdb0-b0e6-5120-9722-746684ecd44b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:da0400e1-0008-5168-b850-85329ab48e23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:7a1ac8fd-5bdc-5a30-88e4-edf14e71e80d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.3.12-tuxcare.5 of @angular/animations, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:be61a483-b6f6-59c9-ae36-91b8902d6880", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.5 of @angular/animations. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:eb9ada5c-ddf2-57e2-84d6-15e46b38de61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.5 of @angular/animations." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:07b17682-9b9b-5fb1-8715-c95affe9b67d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.5 of @angular/animations." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ], "bom-ref": "urn:uuid:c9601ed4-6769-5629-83e3-53bb8774941e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.5 of @angular/animations." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/animations@17.3.12-tuxcare.5" } ] }