{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:41c98cdd-8773-5c8b-ae66-d222db890e25", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser-dynamic", "purl": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1", "version": "19.2.25-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:5ac22175-a79f-5bcc-b867-6f64cdb36c3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:b72d5d26-779c-5a41-866a-1ece2629c8e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic. Angular 19.2.25 is NOT affected by CVE-2026-27970. The vulnerability (XSS via unsanitized attributes in ICU message translations) was fixed in upstream Angular v19.2.19 by commit 747548721d authored by Doug Parker (Angular team). The target version 19.2.25 is 6 patch releases after the fix. The defense code is present at packages/core/src/render3/i18n/i18n_parse.ts:843-867, implementing allowlist validation, URI attribute blocking, and unknown attribute dropping. This is an upstream vendor fix, not a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:0299af09-1de3-5a36-b7b3-ae1aa949c14f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:fff35e90-9c9d-55b4-af1a-cba9ef038304", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:00856ef9-1117-5d68-9332-7a30f12f4c85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:02661ae7-823a-5576-bc87-28a3267b3a4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:344a4ba8-99cf-5fb5-a60c-71d39c3589c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:05d17d69-07aa-59eb-91ae-13678967a6cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:ccf4c5b3-c837-55fc-a214-6537e1b15acb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:09d19320-47ce-5d35-9c72-a017905f677b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:e5cd10fa-8a8c-528c-99c4-b7fce728f602", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:a171929f-a5ab-54e0-aaad-60f213c0d57a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:6eb702b5-6f43-5e9a-bfdf-d4cdac3820ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ], "bom-ref": "urn:uuid:7f950d32-59db-520f-9230-4ce921610906", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 19.2.25-tuxcare.1 of @angular/platform-browser-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@19.2.25-tuxcare.1" } ] }