{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fb24cede-3792-5149-b062-b30104f0384f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser-dynamic", "purl": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5", "version": "16.2.11-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5292a50d-ce04-59e7-b9a1-dd80d14b3999", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:00f2c6d2-dddd-5dc9-9b43-e58a1249c196", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:51928ff2-0d99-5564-893b-2a1bfa392267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f2442bdb-3a5c-5fea-9c6f-ad2457fe3746", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic, and is fixed in 16.2.11-tuxcare.6." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:66b3ce72-6587-50a8-9c64-808df18c1fec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:15ad9558-8d6b-51bc-93dc-131f635752b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0c294546-00af-5e13-b90d-81f30465f809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:599900ac-438c-55cf-8f03-a13394444df3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d10f599c-9033-5a22-9cff-0e824718f871", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:2fcb0629-e0d2-5964-824f-f0a8c18da843", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4848357c-2c2c-56dc-b290-8b07aada61fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:2187a7f0-0fd7-5ad4-a16a-1629a5a4e50d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a2fedbf8-7abe-5db9-821f-692c8bd7a8ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:abe9dfd4-ce4f-52fb-8077-660f1fdf6d5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ca99c5c6-766a-5c38-ab19-7f463557e0ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5cc7cec6-54bf-5bdc-a172-db7e1fb5c7c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9cd65689-9d02-51b7-bf16-5dfbc91181f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4f25ecd8-d928-5690-b65a-95b2e46581e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:52dd330a-2d6d-5050-8239-dcc992ed35c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c7d467ea-a254-5639-b2aa-f33c078b5ac4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:2918fd58-692e-5d49-80c1-a9abd5e6cf7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:e5cdaa8c-611d-5c6d-a058-e0d85968355a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:69fe2064-7778-5a2f-86a2-e09dabd3d004", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4678d95c-0c9c-5293-9553-642da291e67b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:512ce6a1-1b11-598e-89bd-57daa35b523d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5752c241-9466-56d4-8d51-2253775a5690", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b5850fb3-3274-5db4-b2d5-d99cf5a79560", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d6e80c64-f57b-5f31-8231-e5712126f320", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:34db3093-2188-5681-8681-c7fbb49b8016", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:032b1c79-04e4-5230-a93c-f16043432ca6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d0426262-04e0-5ec2-9ba0-e63bb39e7199", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.5" } ] }