{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7485550c-6203-50d1-aad9-f237c77d1401", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8", "version": "16.2.12-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:3792b30d-3211-5c4e-b394-b4026e933cce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:f5e80b82-1fd3-5e19-a126-700d8769d686", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:f7294c35-b3ef-54c9-bc02-5f73c2169aaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:8da2b71d-6852-5be5-8892-22be8da360b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:2111d52d-55e5-5fa2-a5f6-208c9af27b5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:7f0bca4b-8e59-58f1-b0ab-ecc3d95d0053", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.10." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:fbf6d942-13c9-5086-9628-e1ef6a86a4dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:472b9bd8-ae83-5a74-b66c-e63e948671cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:6691f86a-81df-5e3c-8d5b-2d6653a9fd43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:021f6c44-7b10-5d3e-962a-812c62e1302b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:b53f5480-e1e1-5523-a058-7c2dd4dce621", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:198efd97-f83c-51d6-8b05-64dd8f799e50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:5183dfe2-e7f0-5d26-afae-b2c53d51aaec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:c875c1ee-0c76-56fc-b0cf-f0a21f61a5cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:7f20ec87-263b-56bd-beaf-9368b3f1ac59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:6d8b8103-fea9-56b4-9e52-711b4abbbe5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:e0b468ba-647d-5361-9228-f52f30466306", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:58c7b9f5-c5dc-5e1d-a55a-900766bcb749", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:429917df-9e0c-51ff-96c9-0be8e00ccf58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:ed075a89-2495-593d-929b-a0208ee1e9cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:78165c7c-b7d2-5946-a171-de6100d9aa93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:3e728a49-e0ae-56cb-84c1-9659202e1dfb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:4fd13f31-d5d9-54c9-884c-2e5e074188e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.8 of @angular/compiler, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:db9aab76-c8dc-5a6e-9a07-23b913e667b8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.8 of @angular/compiler. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:4c240d33-8894-5377-b113-676595501d13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:422cc90d-e614-508b-a723-f6869e4d9813", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ], "bom-ref": "urn:uuid:57abb5b2-161c-5d69-b96a-b80724906d5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.8 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.8" } ] }