{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:600bc79d-ab07-560a-b21f-43dfe7b36faf", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4", "type": "library", "name": "@angular/platform-browser-dynamic", "version": "17.1.0-tuxcare.4", "purl": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:95d128b7-d784-5833-b420-bd77f92470fb", "id": "CVE-2017-16009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-16009 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:149a622f-0371-58c8-aac8-fd51966295e9", "id": "CVE-2025-59052", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c1780c31-39b1-5d64-a5e3-2601d520c194", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9d0fee14-77be-5b16-b74b-31343ce084e6", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a3c5c79b-187e-572a-bbf6-19367ad615f6", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4b0f9f19-5175-5e93-a325-1513f8c82013", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7469d066-cdbc-58b0-949f-c7407a209293", "id": "CVE-2026-32635", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:dd328dcb-29d6-5ebc-9944-d8d2b1554d8a", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4fa4446a-eda5-555c-a4e6-db5d224f7987", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0dd73b2b-fab4-5aff-9f4b-fe37fadf30bd", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ba747f07-51a9-5248-b7e3-20efe0573494", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d88b3051-d5bd-50d5-ac28-890404df1879", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cf0c6290-9788-5cbb-a463-c058c781ec4f", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e5ac630d-0d4c-515e-8ebd-1f83cbc8cd1c", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8ec27116-3d34-5d48-9c85-8f1ceb7c6f8d", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cf65861c-921a-50cd-b202-7d401b8bbc2a", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4e281fa5-0fc4-594d-bb46-eb692fe02de5", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d4c4e02d-fc7d-50f3-b32b-4a78868a78ae", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:08f7c91f-13a3-5d47-8620-db6c0913ce6c", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:582cb7ec-3b7e-500d-b472-c7633657c769", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8792147b-04bf-5d05-9391-249d3671f065", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ea77fb96-038a-5dba-9c17-18ddf5b26ef3", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f2b98c53-cfe0-55ad-b113-336775c594e6", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3deb3666-0920-55f3-89e9-cea932e70388", "id": "CVE-2026-68945", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:abb6ed48-fb55-5c87-ab12-7e224067459e", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e2234ebf-2359-55a8-843c-cd339ca42a0d", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:73e67aeb-b2d1-5ed5-91de-1ee918375658", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6ed55dfb-60ad-5100-bcef-a292690f9619", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:57310b48-d36d-5b83-861a-793c1ebb8e1b", "id": "CVE-2026-88059", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8a4b3aae-1c92-51e8-ab0e-5e5d6bca4587", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.4 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@17.1.0-tuxcare.4" } ] }