{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e846d254-21ed-50be-9f97-0ceb5f6e918d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@19.2.21-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7", "version": "19.2.21-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:5a9c3f44-2722-5de7-8d8f-041b1ef9d163", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 19.2.21-tuxcare.7 of @angular/common. not_affected \u2014 The Angular repository (version 19.2.21-tuxcare.7) is not affected by CVE-2026-101895 because the vulnerable code does not exist in this repository. The infinite loop vulnerability in DOCTYPE parsing exists in the external domino library's HTMLParser.js file, which is declared as a dependency in package.json but is not vendored or present in the Angular source tree. Angular's @angular/platform-...", "justification": "requires_dependency" } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:361d68ef-9018-52a4-8adc-9bd03c531cc6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.7 of @angular/common. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:b6e1e223-0d93-5892-9182-16a1e96d913e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:17dfc069-e913-5df8-bffe-c83cecdfba25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:7272d10e-722e-5e38-b771-6a868660b3bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:c3472c84-ddd7-511a-bc76-2e32cb4fcde7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:5147d47c-d866-55d3-828f-e7bb24752d09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:a784cbf0-c589-5822-9701-893be530e5cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:d43da04d-0a22-55dc-9332-7cdecff42651", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:835c9d08-6b08-5697-b425-5f82241d3980", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:b1419184-81bd-5d08-98ea-84e9fd99d98e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:384de43d-79f1-5671-a66f-704064fbadf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:b1a242a3-62cc-5808-b97e-00e524e049af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:3cc9cfb5-89c4-50b1-adf8-0725e55a5b1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:e0aff038-3468-569a-852f-05c57f94a544", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:4ec90d24-5bb1-524e-9eb1-216d455d723d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:703393a9-412f-5fd2-8b3a-5ce545f71739", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:ab51ccbb-1bed-5c48-873d-f94a3ec780c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:f5a57568-c1a8-515d-9491-cdd435f5b6d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:0f654958-96e7-5606-9dcd-7094217babb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:ebb3292d-efc1-53d7-ba5d-4bf524db21c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.7 of @angular/common. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:d08d40ee-c975-5585-9f9a-2fe53d42f87d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:9fed563e-99e3-5d48-bfee-cddb0a8ae7df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:5b950152-993d-5aab-99e8-6d8a142d2a07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ], "bom-ref": "urn:uuid:4cb64b94-40d8-5794-adcc-7d8aa9ae9150", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 19.2.21-tuxcare.7 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@19.2.21-tuxcare.7" } ] }