{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ce6b4922-7184-5c7e-a966-761635c724ef", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@16.2.12-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11", "version": "16.2.12-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:049a11a0-b95b-5256-bc14-3c50f2958f84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:88158c6d-8134-581c-b98e-e80c385fc725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:53a7aaf3-705b-5645-9af7-3f80c48dc10b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:02d517d7-c2ea-5199-80be-6edf2a238d34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b467a513-f438-531d-8415-b48b39535814", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:faec80a5-e17b-5c9f-849e-444c85d5b449", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:ed7ebab6-5c8f-592f-a9cb-fc5579b8016e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:9242c347-4509-51bd-8787-dfd63459b1a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:0e70af80-1f74-5650-8cf6-34bfc3f6f52c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:ba48ca05-6486-549c-97d9-8d5477fe1c40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b0931858-17b2-5443-bc51-1dd817e27fac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:910e755d-4517-57bf-af0a-fe04ec381fd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:6b21741c-90b5-55e9-bf54-aa7536b58a3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:51688254-c00d-53ef-a97c-3f0744a6d83a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:d7c87144-9d0b-52c1-845a-47e8e0f95e2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:0ad26ea3-3ccc-5871-94e4-b1ac26f20113", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:ff89b626-7a07-5529-8ae6-6fb2bae786dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:6a327120-d8c9-5185-9273-0c1f97c8bc23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:01bb54d4-ac7a-5dcd-bff8-ffe1df3c59fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:13af4bcf-bfa5-5747-b506-31d024a0f764", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:c96b8042-6570-54ce-afae-ce72d580502e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.11 of @angular/common, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:9ee3a0d8-c32f-5858-8ccf-f011302e091c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.11 of @angular/common, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:5d8a67ad-e044-5a3e-a97c-e186776d6a66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.11 of @angular/common, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:9fb45bf1-f67b-50e3-8f01-21ab176d58c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.11 of @angular/common. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:fa185844-1be4-58c2-9e39-ff2316326e5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:48d32362-3468-5021-b3c8-debb89fd8bf5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.11 of @angular/common." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:2f96e0c8-eb48-5754-a0b4-2b05375f14ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.11 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@16.2.12-tuxcare.11" } ] }