{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:734cce83-5f18-5301-97ee-83abba0100ec",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/compiler-cli",
      "purl": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7",
      "version": "7.2.16-tuxcare.7",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-4231",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0e5a31f7-736e-52ca-8877-fbe2250107cf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.16-tuxcare.7 of @angular/compiler-cli."
      }
    },
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:792f459f-af73-55cb-95ec-66b8f04a7842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-66035 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.10."
      }
    },
    {
      "id": "CVE-2025-66412",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:94698003-1b80-5c2d-a643-ba3195d2321c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.16-tuxcare.7 of @angular/compiler-cli."
      }
    },
    {
      "id": "CVE-2026-22610",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e78cb4e9-0715-50b3-89af-c66311ca72f8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.16-tuxcare.7 of @angular/compiler-cli."
      }
    },
    {
      "id": "CVE-2026-27970",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:29b34263-75be-5638-b3ab-f0a0788a7620",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.16-tuxcare.7 of @angular/compiler-cli."
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d31acce2-db57-53d2-83c2-482692f53b84",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46417 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.8."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:516956e8-3b36-50e1-b886-bfbb07bbdfa3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50168 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:841f1996-db4e-59a7-8c06-bda24d48f9b6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50169 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7000a856-7f9a-5373-82fc-99fcbbc53a3a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50170 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b7d13d07-159c-544e-acd2-d44a3850d71e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50171 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:834ba4fc-1d07-5f3b-90b4-25b8612004b2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50184 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ac02c5ce-a92c-5bf3-be37-0b277dc27580",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50555 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:14c5d0dc-7955-5963-a843-2181d2bb5534",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50556 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-50557",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:369f91a6-ca52-5e66-99c1-6c53d3d78616",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50557 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-52725",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d0d733dc-71c0-59f2-8728-0249ec69bbc2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-52725 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:aa6115d0-a1ad-57ab-97bc-875ff67cce4b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54264 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-54265",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ced75326-268d-5033-b0eb-83c25750bee7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54265 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:97c1bfab-29a8-5331-85d6-dedfc4fd5af9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54266 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-54267",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:86e087aa-de81-5721-8193-90aadeee54be",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54267 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:4ae0ebc9-860c-5cc0-ab4e-1563223bc2a2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54268 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f048f72f-e32e-5c9b-ae8f-4492a9174c43",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.16-tuxcare.7 of @angular/compiler-cli. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-68945. The vulnerability concerns HttpTransferCache's cache key generation logic that treats repeated HTTP parameters (`?role=user&role=admin`) and comma-separated values (`?role=user,admin`) as identical, causing cache key collisions. However, the HttpTransferCache feature does not exist in version 7.2.16\u2014it was introduced in Angular v16. While v7.2.1...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2bc07bfa-1807-598f-9cb3-e21ef041f053",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69149 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-69151",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:25e0fbef-dfd5-51f1-ad48-5f9e0ef88e38",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69151 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli, and is fixed in 7.2.16-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9a837a18-2bca-5309-9a04-8dd9388ecab8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.16-tuxcare.7 of @angular/compiler-cli. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88056. The vulnerability requires a String.prototype.trim() call on URLs during server-side rendering that strips Unicode whitespace characters, converting same-origin relative URLs into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 7.2.16. The CVE describes a vulnerability introduced in later Angular versi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88057",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a43ad027-8fcf-5a38-bdab-ae7447be44a4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88057 does not affect version 7.2.16-tuxcare.7 of @angular/compiler-cli. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88057. The vulnerability exists in the Ivy compiler's template pipeline (introduced in Angular 9+), which does not exist in this version. Angular 7.2.16 uses View Engine, where the SecurityContext determination for directive host bindings correctly uses the concrete host element name (`element.name`) rather than the directive's selector. The exploitati...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:73523e89-4e5c-5dee-8c96-b93c474f584d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.16-tuxcare.7 of @angular/compiler-cli. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and client hydration features that were introduced in Angular v16+. Angular 7.2.16 predates these features by approximately 7 major versions. The codebase contains only legacy TransferState (manual key-value store) and NgModule-based HttpClient (no hierarchical delegation...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d9c6661c-56d3-5e05-931b-0e04deb87f04",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88060 affects version 7.2.16-tuxcare.7 of @angular/compiler-cli."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/compiler-cli@7.2.16-tuxcare.7"
    }
  ]
}