{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:628ca1a4-0a28-54bb-990b-958c1000d295", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@19.2.25-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3", "version": "19.2.25-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:bd7e5293-db1a-5f5b-bab7-97c1bca81521", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:c092e50a-3690-5146-9989-8eaff22297d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:059155e7-bff5-5e18-b520-a47ed92de4a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.25-tuxcare.3 of @angular/router. Angular 19.2.25 is NOT affected by CVE-2026-27970. The vulnerability (XSS via unsanitized attributes in ICU message translations) was fixed in upstream Angular v19.2.19 by commit 747548721d authored by Doug Parker (Angular team). The target version 19.2.25 is 6 patch releases after the fix. The defense code is present at packages/core/src/render3/i18n/i18n_parse.ts:843-867, implementing allowlist validation, URI attribute blocking, and unknown attribute dropping. This is an upstream vendor fix, not a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:0553ebe8-0a1a-5b12-984e-83224ecb3dbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:a8400c0e-5a87-53b2-94f7-c976195f8d03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:05c998bc-40de-5d84-a437-b54ec40b59fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:80b4a6f9-1fe3-56d7-9ca7-670ce1c0ea15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:04171b9e-6335-5d14-a457-abbf0299911e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:b46b491d-63ef-5561-b5c8-27fd9dcefd71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:5f8097cc-5052-517e-b913-bb8db9f298f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:3e37b0d9-5e37-56ce-b809-6776769df8d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:9ac03cd4-de1a-589b-9c78-bd5fc54fd9d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:c879bba5-2076-5376-9525-11afd9953719", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:c75022a0-175b-5dbf-a473-6e47b9da992c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88058 affects version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:967e8c8a-2dea-553d-9713-cf0c9254669b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 19.2.25-tuxcare.3 of @angular/router." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:0e21d489-98ef-586d-b1b0-c0a8056f7d81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 19.2.25-tuxcare.3 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@19.2.25-tuxcare.3" } ] }