{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:39713bfd-fa10-573b-849a-a5c6c06ca394", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17", "version": "17.3.12-tuxcare.17", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:9f90c04e-0d9b-5f48-9815-4a610265baae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:656bb6fd-d232-55e7-9642-cc3e1f2673e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:ebc38b59-c913-526c-9689-41a65c2c0f93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:003fc40b-2350-50ce-a284-233f1bfbbcd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 17.3.12-tuxcare.17 of @angular/localize, and is fixed in 17.3.12-tuxcare.18." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:e43c3e87-cdb7-5260-af03-dd2474b6adf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:faf104a5-8b98-5e6f-9db3-b377e6fab54c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:9903102f-104a-5cdb-9bf3-b4ed75cb5dca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:a849786b-cb9d-51cf-8bc7-8849fa50103e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:64de8d8c-b66f-5798-aced-abda13540d00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:981761d0-127c-5014-aab2-c2cfacddb14b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:744303d8-914e-56cb-abaf-eecc12d7ba7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:f5416018-f1f4-5aeb-afa3-0b355029a14d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:24b9efe5-abfc-5347-90b6-c8213ada53f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:8e515bb6-372b-5bb0-95fe-04d43b265c85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:3ed28543-cbde-50c6-abb1-8c5b0dc85a60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:15d16784-eb06-5c70-a061-9fae42d64e2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:c2c20ea1-ad17-54fa-8c88-8d1b756be2ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:6dda4e77-8125-555c-b592-c185d4969ea2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:3cea7a3e-13c0-5666-b15e-5662c287936e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:034f938a-0149-5065-8fbf-9a7144f834a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:f9693ab4-5ae7-59f2-b34e-57508010eb88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:478cb70f-9f5d-55ae-8d1a-7967dbdd9e9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:fb1a6f10-2091-5a49-847e-cf5527ccf9c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:b279beff-bc30-5a0c-b8d2-c694b72aebae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:cdc7fc0e-0caf-5d23-8d73-af70c8bf3bf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:3def6d52-021e-560f-ac60-66711df50160", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:5f0dc69a-16df-50c5-851f-84c53ed5f7bf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.17 of @angular/localize. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:5cc245b9-892b-53a2-b656-278bea7da772", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:44bb6430-3720-541e-904c-e4727ab1d8ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:9bcd0ef6-8192-51fa-b5fd-9476de5f52a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ], "bom-ref": "urn:uuid:7ab95961-76cb-50ed-be7d-63e36e98a99f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.17 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.17" } ] }