{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9f2e6eb5-d3a5-56e5-ac2e-1c4b8371460e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@19.2.25-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6", "version": "19.2.25-tuxcare.6", "pedigree": { "ancestors": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@19.2.25", "type": "library", "version": "19.2.25" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:42713838-becc-5de9-ac81-705c36073fc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:76f5f24f-2b2f-5e36-99ad-cb84577dcd43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:4a86f811-4913-5015-b74f-7b7493075a00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-111753", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:7208db32-01e0-50b1-97f7-220c5157d044", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111753 affects version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:a058c951-51a0-5e9d-a614-a2e20e2b8819", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.25-tuxcare.6 of @angular/common. Angular 19.2.25 is NOT affected by CVE-2026-27970. The vulnerability (XSS via unsanitized attributes in ICU message translations) was fixed in upstream Angular v19.2.19 by commit 747548721d authored by Doug Parker (Angular team). The target version 19.2.25 is 6 patch releases after the fix. The defense code is present at packages/core/src/render3/i18n/i18n_parse.ts:843-867, implementing allowlist validation, URI attribute blocking, and unknown attribute dropping. This is an upstream vendor fix, not a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:baf94172-2e25-59a3-917f-d72b4ba171aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:bc306577-2ba3-5372-a69e-7900875886a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:7a63efbd-b49d-586d-afb6-6dbcb9a955e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:1a4e9441-66a3-5da6-963e-46ecf3dcc080", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:46fdff18-024a-5997-9e48-d4cb15c993e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:a0096dc4-ceb9-593c-8864-c1e1af827138", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:da67654b-3226-5644-8266-652501c788cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:6b1a803c-0feb-5f9d-8a1a-a646c93ee0b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:9ea11ac6-1d6b-5221-bf69-8aa928d2f4c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88056 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:505b12f2-fb57-5b55-9603-40f244feed4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:56a91d72-adef-5a78-b4ce-8e9a9b1b26d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:cc2e8cac-c332-5e4f-ba1d-7b9b569c2c0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ], "bom-ref": "urn:uuid:0def4148-4374-5329-b7e5-bfca80e1f121", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 19.2.25-tuxcare.6 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@19.2.25-tuxcare.6" } ] }