{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9d315520-c53b-540e-a2ae-b9c0636e939a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser", "purl": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1", "version": "16.2.11-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:e883fbd1-6c93-587f-ac7e-29b32d0f9201", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:d5b14755-3079-58fa-a734-4a23faf0f70d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:e079d6db-d4a3-5396-82b2-1a84fb0e2dc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:7dd9d029-0dc4-59b3-83ed-18e13057de92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:ed8ec464-52b5-51ca-bdb1-58bd15e16e48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:30388b04-5136-58cb-973f-495dde7f3c3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:8b353c27-60d8-5487-ab9a-ea7daf055f0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:d5fa6a2d-661d-5871-a6ca-d49c3befd8c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:ee35e843-e121-50c2-9671-73cd99b9bcf5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:e100419d-9f4e-58c3-8218-30133d467a9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:42bf797c-24ea-572a-84a6-bea1e00bdfce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:ede7ab54-438d-5c52-8e70-89cc98472796", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:c0b2b514-50af-5b72-8993-8dbc5da8b550", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:ff59137a-40b3-5074-ba80-bb874da03652", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:7400c2bf-ef67-5b47-9db5-2217622a912e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:dbec11c7-1713-5e18-b685-fa59d0c0f297", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:b083934e-2297-550e-a441-820ebb9a1432", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:9ec5c499-3947-5c4f-88ad-5d1467dd8a1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:79d4d51e-8841-515b-9bda-0c693f3152bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:cf200856-f9cf-5995-9bef-b70e930b4ae8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:d5cf1530-6876-5cd3-84e9-163f454e0e5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:5fe583c5-9535-5ccb-af19-abbf24ff4e2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.11-tuxcare.1 of @angular/platform-browser, and is fixed in 16.2.11-tuxcare.2." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:92bdb4b1-8030-5e43-998e-36f1f02cc274", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.11-tuxcare.1 of @angular/platform-browser, and is fixed in 16.2.11-tuxcare.2." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:675bdc27-c6ce-5dac-99e7-e0b27511b9a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.11-tuxcare.1 of @angular/platform-browser, and is fixed in 16.2.11-tuxcare.2." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:2ef8ea8b-1026-5bcd-b97c-1f51cb000328", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.1 of @angular/platform-browser. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:c7b29a49-fe42-5085-bd65-7b6e6b1e8c7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:7d8a2011-fe4b-5221-93db-b99d3a972b60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.11-tuxcare.1 of @angular/platform-browser." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:f57303b6-0894-5813-91b7-eab1571ad331", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.11-tuxcare.1 of @angular/platform-browser." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.11-tuxcare.1" } ] }