{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4dffba6c-998b-5959-8665-b921b1f923ca", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4", "type": "library", "name": "@angular/localize", "version": "17.1.0-tuxcare.4", "purl": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9fa8dbb8-228b-5d6d-a844-34d2a7eb29f0", "id": "CVE-2017-16009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-16009 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fafe9137-4115-5753-9fb8-65630cbd9598", "id": "CVE-2025-59052", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:57f05311-a127-5d14-a629-2dbe21bf35fe", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4be5989b-8d9e-5c5a-ad46-2853dd02ceaa", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a85a77a6-5e58-5f17-925b-2366aa949610", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:16b19ead-b2b7-54cc-9db8-ce202e3adae0", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8d320829-6c57-597e-999a-54e2fc43296b", "id": "CVE-2026-32635", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0d638e30-037d-5cec-9559-c929579deec0", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7f1d201c-c1f8-5c5b-9bba-0b4f9fe477e6", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9501836a-6ba0-5baa-b6da-338f3472df2d", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d69a6b00-ac76-5e23-8f17-742a0d5b792b", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5f45d408-c258-5376-bc3c-e1afd22f148d", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:07888b17-0dd6-5707-a516-ebca27a8d523", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5fd2219a-e761-5e3d-8d31-8b21bc587f77", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:be2ab8e9-ab92-5bff-ae8b-39b63c4481c5", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:199f39ac-c42d-5281-a227-803716bd5797", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:50bed697-230b-57ca-bf39-9d9730409627", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:62cf3c60-de18-5f0d-a077-1eb49c95528f", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a0a17168-2f0e-5bfa-b319-d4d90346cfca", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:93ff9318-eed5-59c7-b863-6e507447c132", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.4 of @angular/localize. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:22719780-5b41-588c-b446-c46a1314d32a", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0d75f416-0b4f-5f0c-b264-229bff30c94a", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:587fec9a-736b-52bd-8155-486aa7329eb6", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0fc05a44-0573-598e-8559-2a2674abb789", "id": "CVE-2026-68945", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c2658c9c-b9c8-501b-92e0-326e079eefb6", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7f331ef9-5e22-59bb-84ac-67acfcc1f043", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f7286d53-2c68-5d4a-b3e1-954d02301874", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.4 of @angular/localize. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but..." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:094b72d1-928d-5de3-9504-84846099b6ab", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d2120e95-ca66-5d14-a6e8-7759482f75f6", "id": "CVE-2026-88059", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2bdb6998-35d3-5a43-b809-f529cd34c9b1", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.4 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.4" } ] }