{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2854e2ba-2461-5ac3-b621-0d27e29198eb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5", "version": "12.2.17-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:6186f892-50ea-5567-ba98-5565523ec840", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.8." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:724c80c8-0f66-54e9-9be1-1a559736828c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:90a5fb0a-a0fc-5197-b746-74263557d6f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:5b54cfb2-77a8-5ad6-876d-3ec33e038363", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:dc40871b-4ec3-56a3-938f-f8ded9e3e732", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.6." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:27823a9c-6f2e-59cf-9c5b-f00b231b709f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:39e088d0-2c04-55a3-9f8a-b9bbec1e63a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:812dcd0c-db78-5f4b-b84b-a5565959accf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:0494110f-c4be-58bf-a1c1-6fc93fed3065", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:2ee410c2-2fb8-5a76-b46d-ec03297a6766", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:2668f03c-2a44-53e5-9d09-af03c28b63a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:98da9c61-2d73-55ca-ba17-4b634c545eb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:3e0df1a8-e541-58c8-959d-60fd92e9bc89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:0a639ecb-3778-5450-ba53-2aeff3449a5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:8464c6c3-0328-54f7-a809-4548020776aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:25e63ff0-dc37-5a58-8cc1-e558a7647d97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:1437636f-423e-5174-b517-eae70575f3a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:41835436-4862-5627-aa50-8b6f15884c5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:db8dfeaa-1cbb-5e73-926b-22c298966eeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:8ca1a183-a7e9-5fb8-8748-e0a0a732f3cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.5 of @angular/bazel. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:ca90ea83-164e-5df2-99f6-093746ac5efa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:a5883eb3-0ba6-54de-9a54-9f9bcefb5abc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17-tuxcare.5 of @angular/bazel, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:30c87c2f-5d74-5b64-a459-4b3036164eac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:75705e8d-f2e7-5ae3-8535-9367ea1f62b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:65da072a-527c-55fa-ae55-9fc3b0962108", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.5 of @angular/bazel. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:be12793b-06c3-54ad-9a57-4beb1011c30f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.5 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.5" } ] }