{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a8c764b6-dd34-5b93-8f66-cc21d4d677e4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser-dynamic", "purl": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2", "version": "17.3.12-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:0b0adb6a-13fb-5c63-9073-14f1da39f53a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:497181e2-016c-5aba-ad67-532f8afd067a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:c9330fdf-36fb-5ae8-a2be-b2a8115aed08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:bef6b42d-2f5a-505a-9f8a-9e2f08f69554", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:085e04b3-d19d-5a15-a75e-14da990480ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.9." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:e3913123-0303-5464-b4fe-f87e40c49204", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32635 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.7." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:b6b67d91-ce0f-5240-a696-3963488fa8de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.12." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:da0c36d3-a5c6-53a5-bbc6-f936c15dcc3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:361105bf-1771-5e54-93a8-ba21492d2614", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:a5991c04-37ac-5a7f-825e-0ae7cadfd59d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:3eb019e3-4ab9-50c8-84cc-2e1b8837de1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:01fc32e2-467e-5de9-8c4b-f46b69116254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:9c43eb44-0bb7-577b-8c2b-4ef43f2e6428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:a0794a1c-6ae1-5f6c-8e75-5ea2e412e3da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:3a3c468c-232a-5ec3-99d1-9e0e572aadcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:cd74cb70-1b1d-51d7-b952-10139cee302b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:2bf2bab6-fe8d-527f-a969-046e86e5486a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:1dd9ca0c-bb60-5d90-b29c-69f7d63aa112", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:ed7e6d52-0995-5532-b087-e635440aa93a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:2cd88943-708c-56c4-b310-4ccdb591acdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:887b7830-5cd5-515c-8f3a-bb8e889f5c29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:5e6ec790-70b7-5486-b715-275bfdae7e8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:d033466d-4e25-59b3-aa27-66c9c8f5cfcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:7e46a562-d4ab-5fc0-bac0-710434ef9a4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:a88d9eb4-bbf8-5d26-a1b5-58c82b7dafbc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:c93ea6a8-9d8d-572f-bdb2-498938698a0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:efdfeb89-ad90-5ee4-b8d2-86b8d2afc651", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:6aa98724-172f-5440-a051-2115ac7e6e59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.2 of @angular/platform-browser-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.3.12-tuxcare.2" } ] }