{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:edb51560-8f81-5295-895c-1ee92a7dfd05", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@12.2.17-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2", "version": "12.2.17-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:92aa06b3-e487-5f06-8585-5c9ace38abfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.8." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:77d2ba2e-4796-5f63-9e94-70a9010599c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.2 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:a7b4cb22-81ca-5159-b2f8-0ef2caf36019", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.3." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:ed5e6308-88a5-5aca-8e25-afbbe111edec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.4." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:100c1ea5-d1e2-5989-ad2e-ed846432c4a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.6." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:3e95c305-7681-59cd-8ab6-2606cc34035d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:c9901cce-9e9d-5703-9be5-e4392db66fdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:973d9381-38d6-5ed5-b55c-6fd05536adee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:0085c1c8-7722-5ae1-9358-b32565f4be9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:84594a0e-1e10-56e6-a9c3-35d1373e2806", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:d571f361-9ff1-53f9-9fc6-143885d0edd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:72b42d6f-02e8-590f-9842-b35fea7e327b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:4d0ad0ba-fba7-548e-8bd3-3fb03c2293db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:01eda226-6dc8-5fed-b077-b76756f39f3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:3b2935e0-9fc1-580a-ae26-30bc93676f0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:a358fae4-13da-5d18-ba27-d9a1c7e34235", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:7586c273-8195-5029-b43b-48f32307d56b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:e4a9272b-3771-5e58-9a3a-a3411c3d114f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:477c9130-85d2-5811-8ea1-b957877c8f89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:f8c7a6f0-7e5b-51eb-afdb-e2599de282a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.2 of @angular/core. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:40cefcb1-462c-5bac-9bf6-b4a4cda40584", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:81a848b2-2d16-5a1a-8abe-c14bfabfab2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17-tuxcare.2 of @angular/core, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:e52c18fe-89f9-5d3b-ae50-728443a856c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.2 of @angular/core." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:9568035a-87cd-5803-8af8-ebee948a9654", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.2 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:4186ef5a-c5df-54c8-9658-07b2bbb8bea3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.2 of @angular/core. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ], "bom-ref": "urn:uuid:49c11475-3380-5549-9954-2ea8e100dc08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.2 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.2" } ] }