{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2b5bd41a-292b-56d4-9466-0e0e23793d59", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2", "version": "16.2.12-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:269825cd-9bb3-5f31-aa82-5de8d15fd33b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:96884082-3061-519b-9481-a7edd8682912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:32cdea4f-0aa7-5278-8e9c-e42795795b3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:1820bf33-9323-506d-9da5-609f4ed9c9cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.6." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:b40ff934-87e2-5424-a664-a0eef08c5764", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.8." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:f05e6bd8-1f0c-5c63-bc1f-2a10b2848d48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.10." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:c45ad675-1972-5a76-ae00-887e78ca86d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:078ac934-fedc-52d8-9c94-bc212636931a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:1c0ba845-9f8b-5c7e-8e69-f682686e227a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:9b6f4661-83d3-55fc-975f-7fb18449c164", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:f3141a3b-4487-5453-8f6f-ebf292b991af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:58977e7f-11d6-5b14-bf13-8cfe03c5b47e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:6c30e13a-f4da-56ae-8fde-2d5c4dfac475", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:067ec1fb-8612-5ae8-9c9b-a55d05011a8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:e2ca5d3f-0737-5824-8226-7522e212068b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:bd6b2cf3-0d13-51e4-832e-e29fe15a5d39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:8fe5b974-dbc0-50b3-bdd9-9609d17707c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:18dc16f1-2b74-5ab2-a128-43b8502bfc69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:1def79e6-4a36-5c9f-b50d-f00826673f0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:727bea0a-9622-5322-a2c1-63944e84e995", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:6dda32d5-0b04-5266-8b87-3067b4106fe1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:1931b968-d725-584c-8ca8-bdd709f0dc1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:178bfcc0-cb3e-5235-b236-02228accc797", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.2 of @angular/bazel, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:520af155-744e-52dc-95e4-a4afcebdfbe3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.2 of @angular/bazel. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:28e6ca05-e90a-5c58-b123-a01918e36131", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:7f1f02ed-022a-57e1-9592-2343c85583ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:8c604770-0004-58b4-9760-2661cddb8c15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.2 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.2" } ] }