{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:416bf28a-d538-5bbd-9291-77523e364b2d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2", "version": "7.2.0-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:dc75d351-4770-59aa-95a0-875fd4ebc2c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:eca7d953-7836-5f4f-a4b5-54d496b92392", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:7955bcc7-abe6-5219-ba83-922f8e8424e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:92ce8507-5933-5434-9796-bdad3c0f0e44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:19de7f90-9ff3-552b-b96b-48ca7b8c53d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:d370957e-1ad9-5f3c-9a30-82b118ae4065", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:75901191-e311-5646-bbf7-f868a0651b98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:e5e458dd-ef00-5569-b2f2-c843b9b430eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:399a30fd-bdea-55b1-b321-d89e52f61343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:43a4c856-9f32-559e-be16-caa8107411d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:aa0581a9-9af3-560d-a59c-220c32011ff7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:11bd87e0-fe3e-5e45-8d68-4a62a3660760", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:222c4bde-e0a4-5a65-a769-5fa44eceff7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:09cf573b-58af-57fa-bcc6-3132f923d9de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:17abcdbd-e6f6-5d3e-8118-35fbdc565700", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:161eaa79-98eb-5b34-9454-0e1d48c133fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:eaf6eefd-6009-51f8-8674-627c60701c63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:874ff643-d0d1-5ce9-92ac-d8b3ee9dc95f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:5bdcb497-a9eb-5c18-a211-486b77c86a27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:40b22777-4cc7-599e-903c-bf6337cfb5e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:411ade02-6954-517c-9621-018aad706a89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:a38750d5-2b5d-504b-bdb3-ecc5d7d5c86f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.0-tuxcare.2 of @angular/bazel. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable component (HttpTransferCache) does not exist in this version. According to patch documentation in the repository (CVE-2026-50170.patch, CVE-2026-54266.patch), the HTTP transfer-cache and client hydration features were introduced in Angular v16. Angular v7.2.0 predates this feature by many major versions. Exhaustive searches confir...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:75758086-6c2d-522c-b886-5645122eca10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 7.2.0-tuxcare.2 of @angular/bazel, and is fixed in 7.2.0-tuxcare.3." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:c78eaeb4-4434-5b98-b438-b3761c7a8615", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 7.2.0-tuxcare.2 of @angular/bazel, and is fixed in 7.2.0-tuxcare.3." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:64dbeb35-c4f7-51ab-b94b-d956fea71b21", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.0-tuxcare.2 of @angular/bazel. not_affected \u2014 Angular version 7.2.0 is not affected by CVE-2026-88056. The vulnerability requires the presence of a `parseUrl` function in `packages/platform-server/src/url.ts` that uses `String.prototype.trim()` to normalize URLs, which strips Unicode whitespace and can convert validated same-origin relative URLs into cross-origin protocol-relative URLs. Version 7.2.0 does not contain the `url.ts` file; it ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:16166814-46f6-58e9-aa8b-4a2ad890229a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 7.2.0-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:4f9bec13-d9b4-509e-bd72-9e2cee68450f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.0-tuxcare.2 of @angular/bazel. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, hierarchical HttpClient delegation (withRequestsMadeViaParent()), and automatic HTTP response caching features that were introduced in Angular v16+. Version 7.2.0 uses NgModule-based configuration (HttpClientModule) with manual TransferState only\u2014no automatic HTTP-to-TransferState caching exists. The...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:00930f58-dfc1-5bf6-8803-948a05df1ccb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 7.2.0-tuxcare.2 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@7.2.0-tuxcare.2" } ] }