{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a554c2c8-eca6-53c9-ae78-2602a199d48b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11", "version": "16.2.12-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:f20a071b-f0bc-5d2d-b996-40a17f821216", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b907229a-7549-5201-8ab5-c346827079cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:1d15b6db-9d03-5a29-b170-aad6e6b09c24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:2055ea22-55d0-51d0-a603-9419fcc5fdfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:5b2711d2-de44-5d58-9ff5-5bd656d1b91a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:d83c142b-fe2a-52fa-b93c-1bb4adb4cfb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:7b1439be-6f6f-5242-8274-c98848b1b708", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:680902f7-4313-508e-ab5d-22db24d5b41f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:8529444c-8263-5911-b04d-2474ccb21124", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:fa515978-b446-5b22-806e-0af3e817ee41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:a637f6d6-398a-5e41-b11e-0f46b304b971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:9e02d138-b252-51cd-b914-d6c7888d20db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:0ba1aae3-9c52-56d9-891d-24329134909b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:fc1a6d62-c5b9-5e67-afb1-e7582e833b67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:0d62a2da-dc52-5e60-b6ea-e25a8df322b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:027cb1cc-e155-557a-bfa9-539b85e89ad1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:48d2f423-d1ba-5795-8e65-69e1a1263fcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b8a0bb11-c2ee-505b-b925-93cd921d05cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b997789f-b36f-5fb4-8c1b-612df12876ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:2a118c09-9d6b-5dbe-8f8c-032dbdc1ebef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b6e4929d-41ab-597f-830a-1269b40f2e34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.11 of @angular/compiler, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:88c1e9c0-365c-5c1b-a67b-ccf3c8b0b324", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.11 of @angular/compiler, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:ca170625-853e-5e56-aac1-282d8616baa4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.11 of @angular/compiler, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:4a706bf6-b996-59c3-9f5c-87bbd142cdda", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.11 of @angular/compiler. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:7254dc3e-b8ce-5030-a06f-93f298da19b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:77443d9d-bd96-5f92-9f63-970fec2d3f5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.11 of @angular/compiler." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:389f1137-b52e-56b4-8fb3-9499fdbf8414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.11 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.11" } ] }