{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9f9cfb0a-b6db-5394-83e8-563e88a0c0eb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9", "version": "16.2.12-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:757cf35b-bab5-57c7-a65a-79320e71021b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.9 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:9297591f-78c4-5faf-8ab9-d46b486de2c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.9 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:3a4b8063-ef23-58af-8094-c5ecf5aac20c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.9 of @angular/compiler." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:db27d649-5588-538d-ab71-a7e24b2f73db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.9 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:30452ddb-f8d6-5d2a-9165-b5e552108fc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.9 of @angular/compiler." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:c39d76c4-7ea0-5e14-b44d-00ec92b79437", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.10." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:ff8393f9-2b31-5516-9629-16afe2994de7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:c27e3590-b318-56ff-8d20-5d6e1017acef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:6d925166-5429-5b73-bf03-b7acdc865c30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:d7d52f43-cd75-5752-b581-73a550e21215", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:2bf298a4-7fcf-5497-a52f-d46b2513c4f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:ceaa25fb-3f60-5c59-938d-606886b82890", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:c1b2cb3f-4689-5dca-9d42-a5df18103804", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:31b8ddf3-a91c-5e92-86ce-361dcf333405", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:e9468325-83d3-5ee7-a3a7-63c8c0a91d7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:b0777ed0-ba4e-55bf-b58f-529fd7429ab0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:4e0845c6-0cac-5249-870d-d798188514fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:d51b4638-f12f-5e7e-9af8-2019dd5dd78f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:cef17db3-5e81-5b77-9322-fbf694549316", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:dcc5f5f2-c48a-585b-8499-7202b776fb54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:b2f013c4-57df-591e-9a04-eb13482963ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:ecf64a25-8c4c-54db-9546-14f78d71a5fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:be9fc7b0-c875-5a61-b4b0-5375d8b3e0af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.9 of @angular/compiler, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:b2efb26a-2507-599e-b321-80684f16807e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.9 of @angular/compiler. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:2a373340-fcbc-5834-a760-ae79a1dc2f8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.9 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:8c22bb7b-73bd-50e8-922f-f7b2c85c6c63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.9 of @angular/compiler." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ], "bom-ref": "urn:uuid:e4ae1c27-6c2f-5072-9575-9b3bffcc8e67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.9 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@16.2.12-tuxcare.9" } ] }