{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:69546b38-112c-5347-a583-70198d9e6acc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@12.2.17-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3", "version": "12.2.17-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:be7b51dc-0bee-57cf-8948-8bae21c8b3af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.8." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:5884c290-51c5-5501-940e-caabd93ac4d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:b000c2f2-67a8-54bd-8cf6-d079e3f8dbe2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:6e9cd66b-227c-5a7e-95e5-52cc4a8cae68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.4." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:0f6bbf2c-3c2f-5731-b1f5-51f386444395", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.6." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:add7dfac-bd61-567c-aee2-782b1071bbca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:a7389c9e-9254-5ed3-9167-97565e487492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:1c04af2c-4c02-550b-99ee-bfc68f129ecf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:ea5cdff5-84ef-587e-9d19-e35fb8aa2196", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:429854f5-2fca-52f8-b27e-b0b80a30c1a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:7f703dc9-0236-5165-a6e6-d5b96b51f2f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:86782f09-98d6-5ded-8464-45b8b6f8c1c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:17c53bbe-68dd-5fb9-89de-c5aaa2a13cb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:94595a9e-3ab3-5e7d-b287-63054a204d85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:0d1b201c-74e4-5513-a3b9-8cc019c57d0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:9c99be0f-fdcf-5f58-8564-b7662a544c7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:a4353447-fd07-5439-add1-1e16c0709d3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:0a76594a-c15f-5abe-9ae5-c14e1a932db4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:ec349421-a853-56d3-badb-7c29a61cb8a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:b6f168d4-f2a1-507a-9e45-08ab9fa1f35b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.3 of @angular/core. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:b7248e6a-caf4-5fca-9482-4989e958a0dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:02732416-b6a7-5620-9481-8e61367b2e35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17-tuxcare.3 of @angular/core, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:edf46fda-084f-5925-bcdb-b84464a70163", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:1006dd25-bc12-5b46-9986-462d2b6af64c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:932545f9-a03a-5ec1-a2d6-8ee023f8ab2f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.3 of @angular/core. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ], "bom-ref": "urn:uuid:6d744526-75c4-50e7-9208-3e088e84a544", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.3 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.3" } ] }