{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1407e6e0-273d-5c0a-8f61-23ea7598797b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser-dynamic", "purl": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7", "version": "17.1.0-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:46b0fc60-5851-555a-adf5-e5abe0a37978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:2cee2d0a-cfde-5d01-b2b5-bcc4b52ba315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:b768f9a1-5226-5e60-bf04-2921872c06bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:b2b06c7c-8430-5ee5-8301-185a08bf2adc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic, and is fixed in 17.1.0-tuxcare.8." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:2c97115d-b0a3-59be-9db1-33255c549523", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:634baa27-1073-5112-8d80-8fd597640889", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:cd588452-21c1-5dd5-a975-70ecfb39b5c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:2edc5555-bc48-5605-bd1d-181284b47dd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:4e108e97-902f-53e6-ade1-c4c51cce4caa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:cfa2a201-6c00-5a88-9820-c0562042fc9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:8790f277-a9e9-5e6d-93df-bdb493e685a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:4642c7a6-811b-5ab7-b92c-bf78688a1031", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:27c8a298-35d8-55a9-ad6f-8f29567520bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:0a3c1318-2426-5199-8998-91f06cf28c7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:641c9ea6-9d5b-5665-801d-2f03e116aa31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:8d46645f-02d6-56d0-a2a4-2e22499ed694", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:1593cc64-dc40-5096-b377-b8ba96be2aa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:a0940e9b-ffd6-5314-9838-a24ec8bc0f9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:11c34148-985d-533a-acd6-ade56071b724", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:230faee0-1b6b-5529-98b0-56851ecab197", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:811bf413-4ae7-5dee-8e59-a64392af6dc0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:55a78492-8a7a-5221-8c12-ed4b38599b85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:37623be1-9865-5e45-bc11-0b215236b150", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:b34cf9f9-bb63-503c-a945-04d642d677ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:6127dd45-1a60-55bf-8dd1-c676667514be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:f88aeaf7-c438-542f-b096-452f09f048bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:fac12410-372d-5340-a9db-fca2703d86af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:6b7eaee3-34ba-5c99-a54f-bda3a9d3c7f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:51ae58f3-2439-5306-a0df-11f74d211738", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:6eeccc44-9d17-5a71-953c-b7ae6d51efe1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic. not_affected \u2014 The Angular repository (version 17.1.0-tuxcare.5 at SHA 1b802ce320) is not affected by CVE-2026-88058 because it does not contain the vulnerable source code. The vulnerability exists in the domino library's HTML serialization code (lib/NodeUtils.js), which Angular references as a dependency in package.json but does not vendor. The upstream patch (89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef) is a D...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:06246dc9-b80a-5c34-a7e6-8d4cb4f997df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:b6f80789-dd41-5193-af57-621013e56307", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.1.0-tuxcare.7 of @angular/platform-browser-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.7" } ] }