{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ca4ac2d1-6570-5b6e-9d5f-5e85e1dc8c9f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1", "version": "16.2.11-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:6e530055-f3d8-54be-94fc-01ebb8adf6fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:3b32c284-d0e6-541b-a0e4-3c778b19f75b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:c1f50631-c056-5f32-8fe1-d7af04008392", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:7fe8fc1e-6991-5ebd-b740-a50e79028f40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:41f8ee62-cb4a-529c-a9e8-86af862de240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:3794f49c-902f-5c2a-b0e3-87b6b92342e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:7e8ee4be-71fb-5be5-a51f-ecfa29693dec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:7a4ed280-2f5a-53e1-9fd5-31facca0fced", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:4272dbf8-4584-5e45-849e-03140a997efd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:361f72e5-d83f-5432-aa76-087b517697d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:b29dc1e2-c09d-5e39-b21a-9fabe5d883d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:698300a7-e9a9-5ca5-b196-8cc202e87a7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:2ef707a0-d009-51ba-bd6d-1d0af6204c1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:e82336a8-bb2c-53a3-bddb-9c9b3bd50d4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:fec92c73-5ff3-5521-b4f9-e43b61e90ff4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:aaea0cc7-368d-57d1-944d-3c4ad3c448f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:d30c0bb9-048d-5900-b9c0-ae02c6f7b255", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:ce290de3-9da4-572c-92c4-e04cdd3ffecc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:c9452d3e-a82a-5abf-8dcd-08c843f8b4d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:7bf980fe-6675-5636-a058-30a0431f5bab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:cc0dbeeb-46ad-54ef-9c29-2364a7ebfc17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:1fe1532d-d43d-5f3d-be31-e02a5ae1c3c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.11-tuxcare.1 of @angular/localize, and is fixed in 16.2.11-tuxcare.2." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:0af80b34-2e30-55f0-b883-78576e78f5a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.11-tuxcare.1 of @angular/localize, and is fixed in 16.2.11-tuxcare.2." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:76dd4ec8-e74c-5a19-831f-963cddba4fb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.11-tuxcare.1 of @angular/localize, and is fixed in 16.2.11-tuxcare.2." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:491ad02b-5419-5251-a9bf-95e692a80927", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.1 of @angular/localize. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:8c8eff5d-69b0-57bd-b969-1c07aed92575", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:278b9adf-170b-58ab-87a7-3229a8827312", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.11-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:498b0e3b-1014-5869-af5f-9a2595917d08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.11-tuxcare.1 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.1" } ] }