{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7764afc4-0476-50c8-afa8-0bf080327ddd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@19.2.21-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8", "version": "19.2.21-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:2e458dce-5c3d-5c1b-88c2-a8da70928305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 19.2.21-tuxcare.8 of @angular/common, and is fixed in 19.2.21-tuxcare.9." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:bc97bbfc-5089-588a-ba8f-5ffdfe8f6de8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:0f986b97-7255-55bd-acbe-1e9301061191", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.8 of @angular/common. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:dce0bde1-0460-55b3-a56a-61e0f1faf943", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:1408fdf1-8bb2-5322-9df0-ef632d59bb65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:aec01a4c-7d07-56e0-8855-b39bba6d1414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:3113c461-0139-5d49-8cb8-3268a9b932fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:9ea20116-7b59-577c-a637-b6ee27a2488d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:398b00d8-fe38-5d61-a04a-0ae6048b8f6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:7b9244cd-db25-5e12-9059-9be7de60e671", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:98ae38a4-8717-56ae-b921-dd6f4d62f6a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:6cf39287-ff47-5727-97a3-f39057c8bd57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:01a4b343-7d43-54b4-b4d4-550aaf2f902f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:97b2b779-d395-5897-845e-3955eca580a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:3cea07e2-315c-52a5-9ca5-a475f15a8952", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:96e2befe-246d-5bfe-be07-5ef0ff24e00c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:16ebe82a-8e33-5d86-992d-db39604b385b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:6891bdc8-7d1f-5743-be9c-87ca236a7a25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:2a6a07ec-60f3-5f60-9fd6-a490d6d46f71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:82368b78-e33a-5a0c-91af-2f476b450dfe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:f5cee9dd-7a75-579e-b028-25fecd1b5396", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:76896793-56ab-5050-9ec3-eb3327468dc5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.8 of @angular/common. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:27564968-0c60-53cf-b244-65b30c5e7953", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:6178e520-c5bc-5bb8-9ba4-eb2bed7eeabe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:789ba774-e794-5ecb-bf13-2b8854708b46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:75e0c600-1228-539b-bfa5-7f350671beb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 19.2.21-tuxcare.8 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.8" } ] }