{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ee05aca1-4dbd-5779-bf9b-4248eb2f3d0a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@19.2.21-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2", "version": "19.2.21-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:1b661aec-45f5-55ab-9476-8e0ebc9c58ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.2 of @angular/common. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:5115ca78-8b33-59d4-b85f-ad4b2ff4b9dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:d3f90471-d0b8-5afb-9e72-77b825151644", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:1b5c7d9e-6e04-5daf-bba3-c99e3b82bb3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:3c6f5bb6-840a-5692-8d0c-8e7d881fa5c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:cc2fb164-b6de-5bcb-bf89-58964732fe00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:12ae37cc-31f4-5227-b929-165162918216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:6c10e11f-ec93-5983-a53c-7dcfb397955a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:94f3003b-4696-506a-a4af-afd91ecf1847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:baf37546-262f-5702-af17-ade65a353bce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:20dc8080-74d4-59ca-8ffc-9017336497b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:5a70c5a0-c885-5a54-854f-056dfc4e0acd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:c7ed94f4-7f79-5284-ad90-682df3ab34a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:5fded4f0-6e15-5944-b921-8af8382da64d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:f91a3ef9-7df2-5b3b-af3a-af248167dcb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:77d5d0dc-c693-552d-bb20-302087c8bcfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:b807fd17-32af-5edd-ac14-e53dc16b7b8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:c82c0d35-f99f-52ac-9313-3ee782737d6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:8cdf1408-4aca-5e78-ad70-ba25ec59c1c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 19.2.21-tuxcare.2 of @angular/common, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:b047e60d-4b55-5e91-898d-6a3a3c343921", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.2 of @angular/common. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:ab5f12c5-493b-56e5-8989-01907ffe891e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 19.2.21-tuxcare.2 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:0355577e-690e-5373-8856-d4829deafdda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 19.2.21-tuxcare.2 of @angular/common." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:bd7d7c93-6165-59b6-a134-89d33bb26ef6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 19.2.21-tuxcare.2 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.2" } ] }