{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c30f94fd-71fe-5548-9121-412ec8799265",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/bazel",
      "purl": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2",
      "version": "19.2.25-tuxcare.2",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-59052",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c19373f8-50d5-598c-92b3-0e75549c62dc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59052 is fixed in version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    },
    {
      "id": "CVE-2026-27970",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:124199af-fcbe-50e7-9d71-290baa5ba10c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.25-tuxcare.2 of @angular/bazel. Angular 19.2.25 is NOT affected by CVE-2026-27970. The vulnerability (XSS via unsanitized attributes in ICU message translations) was fixed in upstream Angular v19.2.19 by commit 747548721d authored by Doug Parker (Angular team). The target version 19.2.25 is 6 patch releases after the fix. The defense code is present at packages/core/src/render3/i18n/i18n_parse.ts:843-867, implementing allowlist validation, URI attribute blocking, and unknown attribute dropping. This is an upstream vendor fix, not a TuxCare backport.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:44ddbe9a-b13c-5d1e-8637-0acf5d52c9bd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54264 affects version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    },
    {
      "id": "CVE-2026-54265",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8146038d-f778-5e58-8bd3-87a0d4667d29",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54265 affects version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e034eea5-c23d-5530-bcc8-d0fd1b681547",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54266 affects version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    },
    {
      "id": "CVE-2026-54267",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a9b85bc9-78f9-5d08-a2b8-7ad7cb50afc7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54267 affects version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8559b31d-ca15-5ccd-889f-352618ba0d15",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54268 affects version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a51a936d-9997-581a-b0a6-629b689ffda4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-68945 affects version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:39516f9f-3f92-5a35-bcc3-e0ab9b35e372",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69149 affects version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    },
    {
      "id": "CVE-2026-69151",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b2e15a4f-4dd0-558e-8d0c-edc475b5d5bb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69151 affects version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b0f0edff-9b1c-5f49-8a89-e9a543418b8e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88056 affects version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    },
    {
      "id": "CVE-2026-88057",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e2c7edf3-3067-56a6-935b-a66cea34ff3c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88057 affects version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:333c1665-d33e-5f26-bdf5-a9b30dba23af",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88059 affects version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a488529d-1a06-5f6d-a4db-7516fe27c2a6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88060 affects version 19.2.25-tuxcare.2 of @angular/bazel."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.2"
    }
  ]
}