{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:02b14d46-8c17-57a1-983d-abbab9eb3a99", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@19.2.21-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8", "version": "19.2.21-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:f6ef600f-adb0-5d2c-b5d0-6ad25455d088", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 19.2.21-tuxcare.8 of @angular/core, and is fixed in 19.2.21-tuxcare.9." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:1afd1dda-a440-5389-bc47-c6a726c1e016", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:e11c1df6-d8f3-58c3-ad86-ade9dcbc4cf6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.8 of @angular/core. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:fb3f21ab-e58d-52a5-a16c-5f042cc54075", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:2c90f9f0-5761-5bba-97c8-974ef9d17f92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:10b19c2e-f92b-57bd-b8e2-6b9d0f2a5c3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:5b459682-ed2d-5eca-8ee6-dccec6db6d8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:5a7e2591-ba1a-5a58-a213-fe2c45d5e312", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:c00bee83-9452-5634-96d6-9ddf50718470", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:73a3c7f3-0a6c-5473-9d6c-15fa3d948ac4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:f6df42e6-4fb2-5265-b42e-f4b7bcfd1a6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:6ad641d1-0a15-53ec-8142-02c06733f114", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:d55f9630-76ce-59cc-aa01-a95b7148960b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:5d39da9e-b61e-59d0-977e-2f6761c8816c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:5821ea73-e585-54f3-b8f3-eceec58903bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:a7cfcce1-33d3-542f-9f91-72abc0e1a012", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:da41f4fc-c58d-54f1-a905-ad0cf6cb5293", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:60ed0ec4-2a8c-53d0-8227-f26edc5ade24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:7aa45063-c851-5373-b6d1-41dd1519ea5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:a7b3f1ed-1e5a-5512-a519-0981b232fdac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:62556d35-83bd-50f1-b68a-2b03ed129875", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:6d4d7918-7e08-559b-9151-f99f34a7eb48", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.8 of @angular/core. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:2f7e1cff-6e9b-5ce3-9df6-1980b4c96f1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:257348b5-2d12-559c-8f58-cf64b72eebad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:37ebb075-9c01-58e2-b11d-c096048e6ddf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:73fc529b-105c-5d71-b28b-9bd385a0f78a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 19.2.21-tuxcare.8 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@19.2.21-tuxcare.8" } ] }