{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cc21d22f-1c73-5f06-911e-690a57804864", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser", "purl": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2", "version": "19.2.21-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:add66155-db39-5083-af59-99c62c50c769", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.2 of @angular/platform-browser. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:5f20d1a3-d24c-5750-9800-728f8435b4aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:6883839a-d6f9-50ab-bfac-fc3c85574f94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:299dc6b5-5b76-5c68-aba3-43fba4f21536", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:7fc9e824-eeae-5e44-ac16-04efbf5d557f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:004195e5-55d3-5f5b-8259-5bdac7c24d08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:39bf9e8f-945e-530b-b3b7-acf55dd60571", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:203ffc3f-6c29-5c46-9e90-8fab837b97b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:6ee4a480-7bff-5f7b-8ac4-b6ab4a958d8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:e064c1dd-1e2c-5890-8ecb-342e861114b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:0365e66b-551d-5f45-a63a-65dbf4bfa968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:daaf8aaf-a67a-50fe-a663-4ad00ad85f04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:32466630-59d5-5a30-b44f-cf62f9b55b5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:84725ea7-0e6a-51cd-80a6-decee3336e3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:8dae4146-f278-5593-975f-4a2f4106883c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:484035d3-14c6-5c87-bd1d-c3cc92b82bd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:2cb0b3fb-b7de-5deb-ab45-1851de359678", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:70edd608-8757-5b2f-ad7e-027641793072", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:3f605683-9a14-5211-a8ed-940e63567c40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 19.2.21-tuxcare.2 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:5089359a-5f23-5cac-adf9-5f6cd1a5a81a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.2 of @angular/platform-browser. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:6f944245-93bb-57b0-863a-31d92125fa70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 19.2.21-tuxcare.2 of @angular/platform-browser." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:4c5545a5-aa29-50eb-9670-9dd08c5a272a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 19.2.21-tuxcare.2 of @angular/platform-browser." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:c69059ff-d5f1-59f4-89f7-9e5cb4f5e542", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 19.2.21-tuxcare.2 of @angular/platform-browser." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.2" } ] }