{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5e6223eb-5e13-5c61-a943-000a25b43333", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser-dynamic", "purl": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1", "version": "17.3.12-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:33dbe8a6-9a56-5705-9da2-f616a4c8c70d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:f597e609-7f00-5a70-8a2f-b1e053385b4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:67db490c-dab2-573a-b4ee-a8fe26000530", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:2eecd5b3-2f17-57f8-9299-cc9676616ddd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:772b4a70-eae5-5129-88b0-4bc9d40890d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.9." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:fb63dfd2-1d56-53d8-bfbd-74446b43578b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32635 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.7." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:53b4e862-5061-5337-9616-df6164549c5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.12." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:8586d509-8043-5aaf-9e72-d1181d001cd9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:d8a52408-3c2d-504f-b954-1dc9b42ff2dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:0dd21d79-b2aa-5d6d-853d-bbd7d89ae4ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:0cea22d8-be58-5bce-a3a2-50991fc8dd77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:4554a748-fabf-5432-8acf-c3e9fde7b90f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:bc652855-44da-530a-8c73-50304be079f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:75772e5a-7e22-5121-a54b-5ffc889d47b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:b07dd369-afa4-510d-bd9e-483edeb520bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:0ee55f3b-5a52-54da-8d82-546737a95b47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:7eb08478-8629-5292-9022-6944bd9283d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:d1c3094c-c98d-5097-83e5-e5cdaecc7636", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:777b2e86-47c6-52cb-a47f-eee0f5171d9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:2173a274-2b52-5108-84f2-c2c3f12ad38f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:8429be27-4319-5159-a6d1-1090d814a3ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:8c0dd71a-f5fa-5f90-ad6e-5e75e36565b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:1408b299-d351-5457-9e28-f899dda5cdac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:6458e40f-6e56-5b99-bf04-65e75839097f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:3c51d497-7aab-5fa1-8a35-6d8e717d04ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:056bd031-ce65-5c60-86b6-5ccdecdb2743", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:285d728f-94f7-51fa-a542-b0e9f7f40680", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:4a9c27ad-4186-5a8e-9433-4ff3e139d9d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.1 of @angular/platform-browser-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.1" } ] }