{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:61dcccbc-c8cb-5eee-baa8-6e19d17b1427", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler-cli", "purl": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8", "version": "5.2.11-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:c90b9cf3-1013-50a8-8206-15d800eb9a76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:a6da8367-30bf-5f31-b0ba-56ca332d8563", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 5.2.11-tuxcare.8 of @angular/compiler-cli, and is fixed in 5.2.11-tuxcare.9." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:ffa4a787-35b2-5835-887f-a838f7a504f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:6d48bff4-65d0-539f-a707-5e28b0f62185", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:b0893afb-c79b-514d-b43c-8b348148b849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:9e94bcfd-c022-5f6d-b1ce-9efd546de85b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:93e8322c-4c7b-5bbf-8a03-883fd30e4010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:e864b4cd-6176-5f87-931d-ae751fb2e556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:6585e04f-1e26-509e-a1be-155e130145e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:1cc162f9-7984-5b1d-acb1-1229e7b58a55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:48f15241-8713-5333-ac80-fd37161b847d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:8df023f5-12ec-5a31-8a48-a6515869c216", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:e78b24bc-b6d8-54a8-af7d-80279e41d232", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:55b8e70a-7698-57a8-8fb2-16f574c26bd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:80fdef87-0a77-56fc-b2b5-01441fe2932b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:c7ad64c1-8534-558f-9fde-dd872d48e0ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:fd7afb0a-895d-5095-8209-c35c964ec8da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:962d5fe9-2bc3-5b67-8617-df2fd9d7b87e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:76969f1f-21ae-54c7-849e-aa44ed39b4b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:a324f233-9ee4-5ec7-82b2-37748785f582", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:46ebbe3a-bdcc-5028-8b1d-4898503df4d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.8 of @angular/compiler-cli. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:c1ca02ce-5978-5233-bfcd-0f3f5fc7a46d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 5.2.11-tuxcare.8 of @angular/compiler-cli, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:7ebfeb1e-e0a6-5095-bb75-f4d4f7692920", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 5.2.11-tuxcare.8 of @angular/compiler-cli, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:a43bc8a0-7da8-5542-852b-ed7ee0950622", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.8 of @angular/compiler-cli. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:81c450e8-ae9c-50a6-942a-9ebf931d5602", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:da9fb9be-c2f8-5977-80f7-f3367bb0c6f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.8 of @angular/compiler-cli. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ], "bom-ref": "urn:uuid:3f1bd653-9ad2-54bf-820e-8a29702dd54b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.8 of @angular/compiler-cli." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler-cli@5.2.11-tuxcare.8" } ] }