{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c3722ec0-1d1a-552c-bd4e-20b2c885186b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7", "version": "19.2.25-tuxcare.7", "pedigree": { "ancestors": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@19.2.25", "type": "library", "version": "19.2.25" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:bf70fd6b-29bd-5636-a90b-416665624e51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:24db90b7-632b-52f2-a91d-b6c7fd12d8e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:1bd7f742-7dff-5fb9-b283-dc618dc5b98b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-111752", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:9d90f295-0a43-5197-8214-c45001205350", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111752 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-111753", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:015bd24f-9297-55b8-a98b-fa9b295e1f71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111753 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:ed38bcf1-77c4-517e-8c8c-6ccbec00f43b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-111754 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:aadf76bd-7fc2-5c1c-a160-186b1d72b618", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.25-tuxcare.7 of @angular/bazel. Angular 19.2.25 is NOT affected by CVE-2026-27970. The vulnerability (XSS via unsanitized attributes in ICU message translations) was fixed in upstream Angular v19.2.19 by commit 747548721d authored by Doug Parker (Angular team). The target version 19.2.25 is 6 patch releases after the fix. The defense code is present at packages/core/src/render3/i18n/i18n_parse.ts:843-867, implementing allowlist validation, URI attribute blocking, and unknown attribute dropping. This is an upstream vendor fix, not a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:443cee00-2afa-5c0b-876e-13c2efe5ed14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:20dabe76-35af-5492-a9c5-4d29f44f784c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:6f76cbc4-af07-59e5-b9be-b7143cbb7ef8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:78dba628-106e-54b1-80f1-d331477b0a0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:4e7560c1-7745-52bd-8ca8-8cd0c20ec8fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:167666d5-ab79-5ba9-ae2d-ee2a705388f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:f70ff56a-94c7-5741-90a4-ede67618df06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:fba78832-d4d5-5b50-a80c-3d868fd4e6c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:ecdf811f-a6b6-549c-b43e-009838d97ead", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88056 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:7a8d5a14-6330-5d7d-acf6-bd71c0f81e6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:7b30322f-2f92-5ff2-994d-0eeace223139", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:031abadb-628c-5d8c-b40e-fd67e91de95a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ], "bom-ref": "urn:uuid:a9f4219c-edd1-552e-a6c3-2b529317d891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 19.2.25-tuxcare.7 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@19.2.25-tuxcare.7" } ] }