{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c48d2b16-7f9f-5a61-b66a-8594345da482", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5", "version": "19.2.25-tuxcare.5", "pedigree": { "ancestors": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@19.2.25", "type": "library", "version": "19.2.25" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:237f4cca-9b8d-594a-9ebb-33d9486860e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:a076e1cf-607e-53e9-8f7c-313b2f4d7f81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:8f265a79-d7a2-5cc7-a204-1f68940469d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:1d210429-1e2e-5f75-b89b-2dfaf0c159f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.25-tuxcare.5 of @angular/localize. Angular 19.2.25 is NOT affected by CVE-2026-27970. The vulnerability (XSS via unsanitized attributes in ICU message translations) was fixed in upstream Angular v19.2.19 by commit 747548721d authored by Doug Parker (Angular team). The target version 19.2.25 is 6 patch releases after the fix. The defense code is present at packages/core/src/render3/i18n/i18n_parse.ts:843-867, implementing allowlist validation, URI attribute blocking, and unknown attribute dropping. This is an upstream vendor fix, not a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:0c255f43-383b-5395-9949-2ec224ba6e74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:9505a730-9195-5d8d-8f0b-e946b4579b8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:4773f17c-4b44-5ea3-a5b1-f8cad798ac4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:db4fa433-3dac-5000-8551-500c1c7877d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 19.2.25-tuxcare.5 of @angular/localize, and is fixed in 19.2.25-tuxcare.6." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:58ebbeb3-9045-5aa4-9c18-7620d7abbe51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:50e386b7-3c0b-5a89-a06c-90d32a2293bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:6e62f0aa-4c55-5ec0-b16d-f393729a1d58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:e99940bb-f1bf-5283-89da-db79ddf25bd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:944c9974-0a3b-5730-95d8-a65f04bf9335", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88056 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:a2174bf4-5c3a-5107-bc84-92f85dc205d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:1b334c09-141b-5493-a294-e97e94e2816e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:1214a962-ef95-5ccb-83fb-3f3273cfad53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ], "bom-ref": "urn:uuid:bad59fa4-d0f3-5c33-875b-6ff69c8235f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 19.2.25-tuxcare.5 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.5" } ] }