{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:653b4157-f96a-524a-ad4f-65ac6f6dbbe8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser-dynamic", "purl": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3", "version": "12.2.17-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:da352eb9-6d68-54c1-bdf7-7eb14e41bd49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.8." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:04b3d9b5-2e25-5fe3-a384-6eb20184f6b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:4a0d870a-7064-5a8a-8e11-d13358cd2410", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:53ce5638-7aa2-5060-86b1-fdca975074cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.4." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:538b2a6b-bb68-53ed-8021-3c9feb48b547", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.6." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:1ed255de-add4-5c56-9d43-ebda0ec7b553", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:789df301-dfb8-53e7-9c3c-a4975ba1e197", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:384ec4ef-7cbc-5a38-987b-0423dbec8478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:07e3b503-0a11-5a09-8e06-0a67fb217247", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:4ccaaaf4-0946-573e-a8c9-c7fe67a3913c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:f0555d05-44d8-58e4-8c6f-f39938614b44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:18920108-64fe-5c70-b03d-87016d0a8395", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:fd699726-c2f7-53ef-bb97-98f6096eb30c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:e2d3b70a-01b4-58b1-b3c1-a1287a710f93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:b0c0a914-72a0-5950-b4a7-32401e9d8848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:37944da4-8883-5aa1-9787-ad2d1b2af18a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:a577c303-4110-50cc-a1b3-43179d404e94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:e134c207-7c4c-5183-b2ba-0a3e87357aed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:4036a2b5-54f8-5a92-8df7-7381d40ef34a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:15b0ce55-9d8b-5b6a-bb06-96db13ca3dd6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:3143b307-d4b1-5a7a-a6ac-647547febc9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:8dd48d02-425d-5ddc-a76a-1863f8274912", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:09c1e9e0-7232-5a13-aaa5-3df42a3b4853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:e8fa1580-8464-5a71-91c1-cf2e08d66c93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:50fdc8c4-d311-5fff-824e-ad75e3e6912e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:30e135ec-0e96-5641-837a-6c9336020537", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.3 of @angular/platform-browser-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@12.2.17-tuxcare.3" } ] }