{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3fdb14c2-7b66-578c-93f6-48703c25c042", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@12.2.17-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2", "version": "12.2.17-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:44eb4de7-0a7d-54ca-a71a-d823386e330b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.8." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:5906f987-379b-500e-a201-ec5cd678c5a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.2 of @angular/common." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:ae1b1164-7686-53d9-a267-596378f3da6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.3." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:98c863ec-a0f0-5395-9a5b-b890191da377", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.4." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:e378e069-b71f-56ff-ab75-f084265f0b24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.6." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:30484809-cb97-573d-b3c3-44ad921914a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:27ee6762-37eb-58b4-bfea-7429eb183c2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:333ed730-02bb-5b4b-8813-701a51bf012a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:d3938919-573c-5682-b615-938e3a98b689", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:edb35be6-0df3-5ead-ba72-9e7ffb318c28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:968c82d7-d37f-5719-9a94-2c11b6eae387", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:2cfee524-1403-501e-88eb-9d88bd2be1cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:bb29367a-2965-5c1e-8ded-10a6a6f6fe42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:7b7258a7-2421-5a15-bcda-3ee274895b01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:39b6e03f-77ac-5705-8cb2-7ff429dcd284", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:c6718a25-a9ca-5fad-8a4d-667d47e818a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:6f208eed-3e02-50f7-b766-6af1b24b5020", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:c5049993-08a5-5afd-be69-60631fe87a39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:1a49a3bd-8ab8-522f-b063-c65369ec2265", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:e287b81b-faba-526f-9b99-bb33b6ed97d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.2 of @angular/common. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:fa7fa77c-0c42-57f3-a6ea-bf815f656bd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:20ac8244-a2af-522c-841a-66e4ebdadd27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17-tuxcare.2 of @angular/common, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:f5840386-7967-5a60-b261-00b52c69bcdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.2 of @angular/common." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:ffa0291d-a601-5db4-9809-1fc005e7988d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.2 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:23ddf5a0-2830-5963-9e9b-f38096a76f93", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.2 of @angular/common. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:85ae2d4d-6802-5843-aafb-c84ca76ac5e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.2 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@12.2.17-tuxcare.2" } ] }