{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:650c65a9-281c-504f-9144-f966d204fd4d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4", "version": "16.2.12-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:60f7751d-3c2b-54f7-a4c5-8400cacab140", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:c5391e33-cd68-5ec0-9e56-cb72e9bc2168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:b8eeea2a-7361-55ce-ae52-8892dc9a2e98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:0fbf1b50-258c-5cfe-af11-bf63766b0138", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.6." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:c036bdb4-4ece-5a11-9fb0-d1da4b7fc2c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.8." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:1a0ef0d1-4d3e-5935-b2ea-21273f7df346", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.10." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:840db6f4-78f3-5bea-9f28-f5b732eb3a7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:d5045569-c779-5bd7-9ef3-f9aa14b678c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:66f17f18-f254-5c40-98bc-da8181ae2030", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:0e5a28a7-6edf-5e48-b9d4-83fb691d8e84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:7e0ed03f-d4e8-5412-8181-beb9974b3127", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:ea1f2ef5-640c-5398-b4e8-8149cba90125", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:536b06ab-6404-5ad6-aba1-50e7dcc884a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:5d17916f-df2e-55ef-9a42-fb7a0f5a5e51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:37d254b7-0522-5bc0-9401-1167d6e5d025", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:68108863-1b17-51c4-9495-47d4679e832f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:89980554-78db-5616-b8ff-444fd2e6e635", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:3870275b-ae7a-51c9-898a-4be19eca7bac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:1ecc3b4b-ebe6-5d00-8c2d-b4871a051396", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:7ab78432-71f4-5cc1-8fae-36f351ca79d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:1998af6e-5e24-535b-8173-5bac2544a3a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:e828d571-3268-5b80-b205-139556573d74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:45510942-1ca1-5408-a1d2-77df6af94d8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.4 of @angular/compiler, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:3eb46beb-f74e-507d-a781-2efe1b25ecf9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.4 of @angular/compiler. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:9b87fb8a-e721-5e6b-a968-a65fcde4ed61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:5db0ef1e-db16-5e70-975b-42f6a4fb1fcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:7b4efdd5-27d3-50a1-a70c-21bf7fb0b0cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.4 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.4" } ] }