{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a545898d-7485-5c66-a6e7-ea20caf3d08e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@17.3.12-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11", "version": "17.3.12-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:d609a5bb-4b31-5bf1-8859-de1d838cbff2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.11 of @angular/core." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:25ec7b39-846c-5637-bf47-aa186485f338", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.11 of @angular/core." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:8430e793-0cd1-5715-97c4-afcfe8855d85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.11 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:1d1ae52b-d0e9-5eb2-acc8-e5b183d4230f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.11 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:7b7c9bb2-531b-5ca3-b239-6940aac5dcca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.11 of @angular/core." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:86384f3e-dee2-56f7-ac9d-869e152686ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.11 of @angular/core." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:773f016a-d279-560c-885f-cfd8042c610a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.12." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:d80730e8-23b3-5d83-8265-6a0bb406daca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:2d7d9894-408e-5ccf-9039-46d7b7eab479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:7f0bb4b3-5fa8-5a17-8430-71c66cf69efc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:6d4f19f9-d068-580a-9a5d-59c6526e1d70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:d9f680a4-7fd8-5cd5-bb06-64632f4fbe6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:fc56d78f-7898-5dd6-a4b5-315d4c8f95e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b8a8a3a3-74f6-54c1-81a5-54e5766aea73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:75f9298e-361a-54f7-938d-f2037bfb7b6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:53a6ea22-e932-5ff7-b7a5-f080480829da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:9f31f3ee-a5a7-5d3c-a2d1-b5fcab3f32bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b53fc97d-bda5-5ffa-811a-1e5bc5cef78c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:6e3f7623-823c-5f3e-ad4a-2d5da2276870", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:875e14a9-ac1b-5061-9104-d3a23519c573", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:1264191b-5aa3-5e6e-92ba-0b2c88c37c10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:be3e6483-ba7a-5a7f-9019-96668fa4a928", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b10f6b60-6b8d-59f7-854a-b52343ff4be1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:19f9e857-5ee0-5e5f-a04b-5a78cd8b2f17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.3.12-tuxcare.11 of @angular/core, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:4b79954e-c6ac-5f71-b017-93e654377ebc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.11 of @angular/core. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:2575ef7d-e801-511b-93e1-22e90ef36b89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.11 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:c55371e8-c6a0-5087-a917-6770ae85d53c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.11 of @angular/core." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ], "bom-ref": "urn:uuid:6bf9ca1e-5f3a-50fc-beba-1c43a0981ecc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.11 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.11" } ] }