{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:145e03d4-035f-56f2-887f-5407b779ff8d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser", "purl": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3", "version": "16.2.12-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:43118799-f849-5cf0-9b0a-039ffd2db019", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.3 of @angular/platform-browser." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:bbc64d4a-b3ae-548d-9a19-31c36743b6a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.3 of @angular/platform-browser." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:8936c554-509a-598f-a6bf-e2361661f21d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:fbf31fd7-7f78-593e-abab-5ef54e163ad3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.6." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:76c6557e-2b6f-5280-b46f-391548e4524d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.8." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:ba79b237-7736-5cec-92ff-edb4a7f4999a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.10." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:a5294d07-96ad-59e3-8496-60920fc3b0fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:f9560863-7167-5f26-b9e7-749137c93037", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:11812cf1-fbea-5f91-935b-2be0ce1db714", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:73e2b258-577f-523f-b2f1-641b7227546f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:f6fff8fe-56fb-56ba-ace5-f20b7f7242d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:81decdbb-d75f-5de0-a2af-7397e384a33d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:1d065555-f8b0-5ad9-9257-23057b08aed9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:9e8532a3-a174-5345-9256-13107e80cf8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:0d62e85a-bbbb-57e3-9a2d-20d48593b9b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:9c6b9c7a-90b9-5ed8-856f-c0944071983f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:e632465c-fb42-5848-8e81-8d0628262675", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:58c180ce-b2cf-54c4-b388-fa08881792d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:9825c4d0-bf8c-586a-968f-b9d8acabfb1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:4a533d9e-4a00-5911-b350-26ce125b1fc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:928d9b9e-2695-5f88-a9cb-d26493000230", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:95b6c94a-3a35-58fb-bcec-965fdf519394", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:0894ecd9-6595-5b89-aae0-ad95f6987ae3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.3 of @angular/platform-browser, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:26ed91b2-7c42-59a8-8937-06ce9a45fc7a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.3 of @angular/platform-browser. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:243fe84a-846a-53ca-bd96-9cb72938edb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.3 of @angular/platform-browser." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:252cd02c-f0f3-5625-95f4-971990a3577f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.3 of @angular/platform-browser." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:92da2b96-c00c-5ab0-a99f-4ffc85b36bd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.3 of @angular/platform-browser." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser@16.2.12-tuxcare.3" } ] }