{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9223f8cf-994c-56b3-9816-efe877f18232", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser", "purl": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20", "version": "5.2.11-tuxcare.20", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:6a41b8f6-dde7-5cb1-af03-fcc4ce19a82c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:82cde8ad-5b98-5fa1-b1d1-863aa4d3e69e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:79dc3713-46f3-5b81-a7ff-90c8788ffdae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:b1a0ea9b-28f8-5585-bd24-f978d5defbd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:342ece7d-778c-5572-8c95-b4c0f3de7578", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:841f9ead-c80a-5ba9-83a0-f7dc16ab812a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:515d82ad-fa99-5103-9f78-a366b9f6f0e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:bdbc1a63-004d-527f-ae59-e426b80af41e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:784f795a-a41b-5976-b949-baa623ad99ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:6740bda3-72bc-5b91-abdb-4ba5b29623e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:ade39fa5-dd5e-558a-bba1-df4cf5f66ba1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:9b9fc46c-d8ee-5e26-9ba1-049a0078d4a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:caa363ee-f8a1-53c4-bcac-2666cd9e6cb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:ac86185b-1833-5fc8-9413-43dfe45c8773", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:a27dd9f7-0180-5fc7-aa60-cc6bcbbfec53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:d303d92f-44d1-5497-aeff-c508a90cc68d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:5f4815fe-e758-5324-ba0d-5443fe2a4388", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:04e95fce-031f-5d62-9539-e408a12bbb5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:11cfb9fa-6388-5056-812b-e26aa47b91db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:3a0692ce-6772-5d06-916f-225ab4fe90e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:90d78384-83dd-5a0b-b89a-35112d3b9d17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:66e55191-50c2-5807-a95c-79481b5ec40d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.20 of @angular/platform-browser. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:06fbad66-49a8-512a-b29d-4929218a81f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:a7bb9c74-a0cc-5a91-bcca-5084b097a99e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:9d02fe75-f691-529d-b4c0-db339b46b534", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.20 of @angular/platform-browser. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:6bffe163-ee2b-5b0c-9bd3-eaba827ce2df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:b2af3bec-9f17-53ff-9355-9c40d45615ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 5.2.11-tuxcare.20 of @angular/platform-browser. not_affected \u2014 CVE-2026-88058 affects the domino library's HTML serialization (XSS via ancestor fallback raw-content tag injection in comments/processing instructions during SSR). The target Angular 5.2.11-tuxcare.19 repository declares domino 2.1.2 as a dependency but does NOT vendor its source code. The vulnerable code (NodeUtils.js serializeOne() function) lives in the domino npm package, not in Angular's ...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:5d25dc78-f105-578d-8425-0be2e8ff6a15", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.20 of @angular/platform-browser. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:3373b9c3-65ae-5a80-a826-7506840405a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.2.11-tuxcare.20 of @angular/platform-browser." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser@5.2.11-tuxcare.20" } ] }