{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:57da6bdd-933c-5330-ad8f-3640e4d727d2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@12.2.17-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6", "version": "12.2.17-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:1f49bb8d-5f1a-592d-bce4-2a78d683f614", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.8." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:4b9f7e67-bb89-5ce2-a660-8b4d5ef457e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.6 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:6b78ae90-2424-5eb9-9a30-4275f3321eaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.6 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:8b61fc45-2d1c-5f39-b777-41ea482b66e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.6 of @angular/core." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:98b156f0-fcd2-5218-8428-dd4e923d8f0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.2.17-tuxcare.6 of @angular/core." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:6dd09931-6c14-572a-a5fb-cadf210e0767", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:546c3da8-140e-559d-8847-64c22b27ce82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:8ea7685b-71ea-5392-89fa-c2199e561b74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:9f25fb92-db2c-5e8a-b92c-2d4b034774ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:797b67c3-272d-5492-a42e-fd1e474c89de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:a98314ed-f7bb-53d2-862f-d698f5d27be6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:db44a662-3520-5e65-a9d4-ace980c8959d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:d91612a7-439e-54ea-992a-ff13ace12969", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:668dffa3-1888-5c10-b35d-7101033be48e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:3c2e375d-9cae-5a38-95d3-c63a0120d2e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:54947ae4-b21f-5127-b0fd-aa100bc08d5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:deb69d9c-aa70-520e-9426-62d932c80a60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:5bf02a6b-7f0f-582a-ab6e-91575b564465", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:4efac606-5663-5dd9-ad07-c2836145367d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:e4020d5a-93ab-55a7-ba5a-88214b446a37", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.6 of @angular/core. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:9ac0e0f8-f2fe-5f1d-937c-d5a1a85c79be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:63445db9-59ad-5c17-b829-cc733335bd20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17-tuxcare.6 of @angular/core, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:0ccbf0ed-70e4-504c-91ab-f31f0cb592d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.6 of @angular/core." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:8f7c0893-f072-5d69-aec3-9b4e043c1544", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.6 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:f9bcc8c5-365e-5802-b17b-bd94cf35200f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.6 of @angular/core. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:2c72e756-4e14-5673-a30e-97c484884f39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.6 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.6" } ] }