{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dff2dd93-0361-51b0-8e1c-fcbd35d453cc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser-dynamic", "purl": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5", "version": "7.2.11-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:56d61633-50b3-5b58-bb57-ced3785793f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:26c45828-21e3-599f-9d1d-418dc724419c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f82d36c4-b43f-5c29-9940-9dcbc549bcdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9d06bb2a-d7cb-5da6-b463-f3128069546d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:627735ff-f49b-50d8-8918-e9f7796e7cfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a0309c00-89d1-5555-8097-09b26e2ed32e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5ee79fe3-5f65-5a6b-993f-b3e38ca19a84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ba78af25-958f-5d46-96c7-9303e99dd174", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50168 does not affect version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic. not_affected \u2014 CVE-2026-50168 addresses vulnerabilities in the WHATWG URL-based parseUrl implementation and allowedHosts validation feature introduced in Angular's CVE-2026-41423 fix. The target (v7.2.11) uses a completely different architecture with Node.js legacy url.parse() and does not have the allowedHosts feature. The specific vulnerable code patterns that CVE-2026-50168 patches do not exist in this ver...", "justification": "code_not_present" } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0f7031cf-9b4a-5b7e-a9c6-00de5076c777", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:75169545-5fc6-551f-99e5-fab2f495456d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v7.2.11 is not affected by CVE-2026-50170. The HTTP Transfer Cache feature that is vulnerable does not exist in this version. The feature was introduced in Angular v16+, and v7.2.11 lacks the transfer_cache.ts module, withHttpTransferCache provider, and provideClientHydration functionality entirely.", "justification": "code_not_present" } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:314ec8d0-eaff-50b9-98e4-cedff4ee427a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8a7c9c52-9947-51a1-98dc-7f80dc41623e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:1592b455-a1c8-502b-b1b6-79feb07c382c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:538dada8-821c-58e3-95b6-d7eff8cf604e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:33a7dcd5-dc06-5523-a869-a129d8219106", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:6520dcc1-d291-5b76-8d62-bee843a40816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:dcb299c1-6922-59c9-ba80-dce88fdc0960", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 7.2.11-tuxcare.2 is not affected by CVE-2026-54264. The vulnerability concerns sensitive header leakage on cross-origin redirects in the request metadata preservation feature. This version predates that feature entirely - it strips ALL request headers when making network requests for assets, as evidenced by code comments and the absence of the newRequestWithMetadata method introduced in...", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9731ce7f-50ec-5a92-9273-a0027c26778c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 7.2.11-tuxcare.2 uses View Engine compiler architecture, not Ivy. The vulnerability (CVE-2026-54265) is specific to Ivy's template compiler pipeline where TwoWayProperty operations were missing from the sanitizer resolution switch. View Engine does not have TwoWayProperty operations; two-way bindings desugar early in the template parser to the same parsePropertyBinding() code path as on...", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0b673c15-8275-59d6-9787-ef2ba63b8f77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 7.2.11-tuxcare.2 is not affected by CVE-2026-54266. The HttpTransferCache feature that contains the weak hash vulnerability does not exist in this version - it was introduced in Angular 16.", "justification": "code_not_present" } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5b29d9d3-4b1f-5ae7-a337-ca859249c507", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:3a1a2cd5-4c1b-50e2-b530-55540cb3667c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7c5260ce-9d31-5985-a914-d5236cc2e7e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v7.2.11-tuxcare.3 is NOT AFFECTED by CVE-2026-68945. The vulnerability affects Angular's `HttpTransferCache` feature, which caches HTTP requests during Server-Side Rendering (SSR) for client-side hydration. This feature did not exist in v7.2.11 \u2014 it was introduced in Angular v16. The vulnerable file `packages/common/http/src/transfer_cache.ts` is absent from the target SHA (8c4c3a453736...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:e5488517-836c-5910-bd7e-2695057ca81e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:25092d64-bf64-53d3-a027-8817162b8aba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:aa20410a-1d45-58db-bf87-1b4708597940", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 7.2.11 is not affected by CVE-2026-88056. The vulnerability requires calling String.prototype.trim() on URL strings before WHATWG URL parsing, creating a discrepancy that enables SSRF. This vulnerable code pattern was introduced in Angular 14+ with a new url.ts file containing parseUrl() that called .trim(). Angular 7.2.11 uses a different parseUrl() implementation in location.ts that d...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:53158bc1-f7ed-505f-b5a9-b4b97d955e98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f945c91b-8b3d-5ae3-96d1-4140c88471f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c63e410b-9e73-5d8d-9c32-bc45b13ce969", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 7.2.11 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache interceptor and hierarchical HttpClient configuration APIs (withRequestsMadeViaParent, provideHttpClient) that were introduced in Angular 14+ and do not exist in this version. While TransferState exists in 7.2.11 as a basic SSR state transfer mechanism, there is no automatic HTTP response caching to T...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:900ac9c6-0050-5bd1-a5a1-5f7bab7a8e40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.11-tuxcare.5 of @angular/platform-browser-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.5" } ] }