{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5489974a-aa96-5fc7-9eaf-791decbac3f7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/platform-browser",
      "purl": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4",
      "version": "19.2.21-tuxcare.4",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-27970",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:958e34a5-8671-5f82-8fec-98ee21e7a290",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.4 of @angular/platform-browser. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c33cf92d-2143-54ff-8b5f-263506d5a22a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:7366d848-e291-5fe4-a518-6c496b034d5e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:9e693d60-bda2-5eb4-a313-020e9e1399c5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6f65dd29-0e9e-5cc3-bf95-c331f6f6a0ca",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50170 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:43cef3e6-9a3a-52a4-a681-f8367b800ca7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:4273ec78-c233-5b0e-9ac0-07a40a367369",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ec497c0a-c68f-545f-8ad8-7da79c8e8b55",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a01ead2b-a5bf-5752-b271-7709d8be82ba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-50557",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:47892751-2f2c-58d5-85eb-50ec74a25f1d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50557 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-52725",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e7624455-e228-5741-844e-6d705fb1fe8a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-52725 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:5ddc3864-85d4-5454-b494-39beaed5079d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-54265",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1252ded7-25dc-5860-ad6f-6635c8521729",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1de1f87e-0679-57e5-a21f-189aef5c948c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-54267",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ead32467-8a20-56b9-9107-de38a1003344",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e1e4d52f-a39a-509a-a11c-afb8138fd061",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ed5f2b5f-a33c-5f34-99da-f4e837e1fb7d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-68945 affects version 19.2.21-tuxcare.4 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.5."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d7fdd3d8-cfc8-57b9-84c4-0a150474a54c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69149 affects version 19.2.21-tuxcare.4 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.5."
      }
    },
    {
      "id": "CVE-2026-69151",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ba7f7b36-dd7c-5560-9e8f-111eca8e3a34",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69151 affects version 19.2.21-tuxcare.4 of @angular/platform-browser, and is fixed in 19.2.21-tuxcare.5."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:03076495-4661-527a-b7a2-501bf7df9a95",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.4 of @angular/platform-browser. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-88057",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ee19c2cb-8b3c-532f-84e5-086eef0e1ea0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88057 affects version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:cfe7e0af-8463-5765-8a63-ba8042e694df",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88059 affects version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1ebfc02a-5440-51c0-a415-1c275d20a101",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88060 affects version 19.2.21-tuxcare.4 of @angular/platform-browser."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/platform-browser@19.2.21-tuxcare.4"
    }
  ]
}