{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b700d1f6-9024-50bd-a2b9-625b5524bb97", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler-cli", "purl": "pkg:npm/%40angular/compiler-cli@12.2.17", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler-cli@12.2.17", "version": "12.2.17", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:a8d4b2df-5a8b-5733-a07f-f0ac4ad87722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.8." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:9f873b12-f571-5154-bdfc-787777fa7878", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.2." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:16eac9f4-3476-5cde-a16d-fce5efb63ce5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.3." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:17814b3e-63db-5c17-8e60-8d0c2f840b23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.4." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:98e2a47e-8f74-5722-aa88-068348015917", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.6." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:cf12f79e-b1d8-5e0e-b582-cfe1d65f1688", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:6708a235-a769-540b-b8ff-70c899b53fab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:157ca3f2-5a79-57f7-8328-bc0462eb2b64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:5cacd53f-5453-570d-8a99-e52297ad4d59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:24d785e7-0879-5c70-9c01-89b3a04e8fc1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:088a243e-aa4f-59f4-82c6-e4dd1989f11c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:1a99b5ba-d6fd-56d9-afbf-70c7debacad7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:9e116d8d-51b9-5123-8249-d6ea046b06ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:43a78d38-444d-54b3-9d25-566f278db2ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:4aaed4e0-2edf-50bd-9135-375e8ebf1197", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:adccb0d3-0699-51d2-bf9f-304ce3244439", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:14d6ea9a-9551-5c07-a1c3-ae2e6977d8b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:0c0c0f7d-f717-523f-97a7-c00919e5b2bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:d310aee9-087d-5b55-b7c0-df2cd96941c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:af44d785-8b77-5a0b-83e8-5c40e1fe48f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17 of @angular/compiler-cli. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:7c17d4b2-a7e5-5c51-89b7-548188a0ebd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:f6cae2a0-c0c5-50df-801d-5c77725d0de1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17 of @angular/compiler-cli, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:ea175202-4c94-575d-ad15-c52d66e8b655", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17 of @angular/compiler-cli." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:f90c4cf4-1097-5a9c-9251-63b159ec7f1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17 of @angular/compiler-cli." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:224ed200-e138-5909-9f2a-ba241845b4c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17 of @angular/compiler-cli. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ], "bom-ref": "urn:uuid:eda6320c-8fe0-5ad8-8f4a-aefb6b5b048c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17 of @angular/compiler-cli." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler-cli@12.2.17" } ] }