{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7404a116-d211-5f6d-ad2d-4921911b78c8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser-dynamic", "purl": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:9f3b18ba-8523-5c56-bf3c-6c003ac3d5f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5de5a9a5-49c2-5749-878a-dcfefcfc36b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:3d4bad89-be44-5bad-a696-cd67013549f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:da6d9420-b8f9-58ca-9dcd-4a995f45a068", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:40ad319c-a241-5cdd-bfea-c1a347dc7bef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e301d81e-02d5-518f-b7a9-240d0ec13bda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:18389c45-c9bd-5796-a6b6-f68168d13e50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:82bc68e1-e22b-53f6-943e-9dea5741301d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2273648c-a75c-57cf-9514-e0e7defecd36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:3c807eef-aafa-58c9-9de9-61d0403fe080", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:420678f9-0ba8-5e57-b325-b8299962e4e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:77b0eb5c-d389-5634-ab24-91233d07403d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:18e7f6c7-346a-5ed0-8ec2-cb81166d95c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2a11c42e-22df-5a64-b62d-e39054fb65af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c8e90947-5700-5268-8c4d-6c5f899a9555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d9b10af8-3e17-54aa-842b-bfa9222b9aaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:533b2c18-29db-566f-8e13-84d2d2b82b06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:42b4f654-750c-5fb5-9b06-0f6da906e8b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:b311a57e-c7d1-533b-a79e-4ea0832716d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e1f4a13c-f1ee-5309-87ec-0faa7a825ab3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:6fc6a29e-d05a-5f90-aca8-e4c973a0c8cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:670ed2c6-6b35-5349-a57b-f0e99bbd26db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:43e026a9-d3e4-5331-b037-4436731f1dce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d195b519-501e-5d1c-a665-d376a746c09b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:876a14eb-0231-524c-9475-959ae14d2247", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:06fa723b-0ecc-5ac7-ac57-90865222c873", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:9501f072-6d07-5bf2-becd-990d15882294", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:07338087-7df4-5d99-8008-5d9f9ee24897", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a2cac98c-6d77-5291-8034-675c9ebe79af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a50ca220-5b21-5e0b-9daf-4c1fe9c917e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-browser-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.4" } ] }