{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:20304378-2e6d-541c-bced-cb62ce7f44fc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser-dynamic", "purl": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3", "version": "16.2.11-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:31a567fd-e59e-5c9f-8370-3f588c810963", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:ebf930fc-ebc5-5a6a-a53f-f59186476b26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:aa279c3c-751b-5596-bc4a-b5c2d72a78ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:64c02c39-f932-5f8e-943d-a6ebc3193936", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:1c9d4b71-274a-5592-b10f-492cd0386040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:f8481eea-636b-5eb3-9b09-0e2831c74817", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:8f16ebe9-c13e-5d0e-926d-6f37cec48731", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:c65b3041-ac61-5b18-b4d1-760520586c47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:fd049562-9e59-5ab3-9bb6-6f04c3131be9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:3d0827d2-ea16-589c-97c8-01e53ea6519b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:3502756d-98b9-58a7-b9b7-4480775a1a6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:a390f942-d06d-502d-a1a9-e49ebbc69c3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:588b08aa-f47b-5ecb-956d-90a541237829", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:3146b146-b1bc-559e-8731-2e67080170e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:fe63959d-040f-5bdd-b2ed-1d98f998f0a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:8f9005ee-a4d1-5476-9706-1beee1eda84a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:07991f59-5681-536a-bf67-763ef73c634b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:43115fa3-58f6-52b9-9504-a1de190e3a0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:140f4ee4-194d-5f70-88cf-0c1efa77d46e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:43441e83-09ad-5b36-bf33-5badebaf95c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:66adae52-61cc-56d4-b0ea-a6ea8b1d2138", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:cbe5eb4e-96ee-5e92-b3de-017baac291b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:1620fce2-ad62-57c5-a853-da0a6c6a1f9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:d9449668-a168-5350-a675-20e397da0d0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:7d140d9e-d8aa-5cea-bbfb-c3006147cf2b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:95013d61-d392-55f6-95ca-c66168d35339", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:2a4c1026-2c09-5bff-a532-add9ba549e8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:38659f44-93ce-53b3-8eeb-f64cd7a86979", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.11-tuxcare.3 of @angular/platform-browser-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@16.2.11-tuxcare.3" } ] }