{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3e7e239c-0cf7-5175-b196-7806bc314ea4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5", "version": "5.2.11-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:34e9a87a-06b9-5a11-bbc8-9b614ccc202d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:1e9c1b9e-2c1b-543c-9da3-8d913c2785b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.9." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8b9dca08-48c6-58f9-88dc-d18e2ab866c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ee08459b-3295-5158-96ad-8c808967fd06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:67cf68ca-4380-5593-a53f-044d9f741dc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:cd3a6b55-c1a1-5b6c-b540-1050d6250a87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:fb014e59-11c0-5548-a476-db8d551aad34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5c5104c5-1222-5c9c-897b-360b8d8a3736", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7c112cd8-803d-5f9c-a7e1-1a3ecb3fff11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a9f335b0-2faf-5872-9d4d-b5fc1fe631ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:e33e6d9b-caa3-55ce-8f72-3958591031d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8e18b317-6a9a-5019-b0a6-3484a1337054", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:163ebb60-7b21-5736-afbd-2755680a9686", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0ec54226-1ec3-5895-a471-41087cf43543", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:2b5ef3a4-86e1-56dd-98bc-637bf182ee16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5474b43d-9e86-5a07-bffe-0b81f613759d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:47db61a5-c4bd-536a-8c00-18818161edd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d1cc83be-8d0b-554b-a5e0-201eb533081d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:95aa4db8-22e5-5593-808b-d59f8eda2a46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:cbeee10b-2562-514a-93d3-c5f932266c1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0c4bb99b-fd2a-5207-8373-287511823b26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.5 of @angular/compiler. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:344b3822-0fb4-55ea-bd15-29065ffaf3f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:709b8d45-43e0-5638-8ae8-d892e28d34e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 5.2.11-tuxcare.5 of @angular/compiler, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7de6265a-e37c-5948-9026-7c977cdb45c8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.5 of @angular/compiler. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:bf95b2bb-500f-5e92-b32c-36bcae637df7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ea212919-6758-5b01-af43-4801c5f6b8de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.5 of @angular/compiler. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c47f43ad-e956-58bf-9601-261463542624", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.5 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@5.2.11-tuxcare.5" } ] }