{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:15cd2947-b21e-5156-85a7-0b4ac32744aa", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6", "version": "16.2.11-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f3983669-0bcf-5433-b822-9ad65210eaf0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:47c644a8-58f8-53b5-aeeb-12d309448f1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c95039f9-a549-5c39-9ad1-ef200621230d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:dd3e89c7-c55c-5c0b-8d0b-aa998be183c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e5ada356-08d7-5c35-b688-dffaf33c457a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:34f6d5dc-8647-58ff-9ea3-774e80776dea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:aec38451-bc58-581a-8d17-6db06532d1e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ed89effb-7116-5ef7-a12a-8b0f7eb16725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:38a2b6aa-6305-586e-a737-be9206daf33f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4544da71-a5ff-588b-bb34-3aa76698652a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b3df2efd-0cdf-5786-9a3e-aad7c354f835", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:fb28e02d-cf4e-5918-a21e-832ec12e00e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a41b7ef9-9d87-531e-912c-2b3a7ee98508", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f091c706-6b08-5023-b507-8e71d9e49626", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8f895258-b34a-504d-a906-8924265d1b3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:75653a6e-3a18-56df-9649-bfb4c0664971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d61705c4-9b53-574a-bb5c-1994a0ff02df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:fd1719a0-7d52-5b17-8bf4-dfa11123b55a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d4a9c63b-2ef6-5566-8e8b-571cb651d305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:92280d42-1632-560e-aebc-bb8462a267a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:651128d7-4bd5-5414-a643-1a803620fcd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:18d5f23b-0e82-5d10-b89a-6ae1f0932e42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7d19287a-e8c0-5c4a-8c66-b795a98ea685", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:eb84fcb8-d72d-5c7c-998d-b857a2299e2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:091baa93-7890-5849-9d4e-ad413a207de6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:60d4e024-5490-5e73-9778-b94092e15c50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c3ea6058-9699-5ad2-bc7f-e4bbae1b3ae4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.6 of @angular/localize. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:313792c6-4785-5ca0-9119-327c3da3ba69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e4b72230-e54e-55eb-a7bf-97e59400eafb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:44e6eeeb-aeb2-5a77-be1d-2b03114e5770", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c1cac045-00b6-5838-ac43-f59946186e1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.6 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@16.2.11-tuxcare.6" } ] }