{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:112808c1-52e1-5d89-8f40-1fa4eb286f36", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@7.2.16-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6", "version": "7.2.16-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:a128e7c7-4b49-5ae1-9938-54f3cafe0868", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.16-tuxcare.6 of @angular/core." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:4ef086cc-9858-5629-b576-dee94b116847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:b34dcf02-f246-5fc7-8c65-d64bdecdcc0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.16-tuxcare.6 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:39fb3a96-9d8c-55a4-b008-fc3b0918eeb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.16-tuxcare.6 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:48a5fbc0-f304-509b-8b65-1c22ed0aefda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.16-tuxcare.6 of @angular/core." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:d99427ee-b7b0-583b-977d-728a6d8e97cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:009403c9-3203-5ffc-a123-eca6d9452ab9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:6883a910-1a31-5364-a272-c0673b6cc273", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:f6253bcb-3d18-52d1-b92e-d11d03d92c92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:730de9da-3407-5d4b-ac5e-a9cce49cf7ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:fac760b8-df19-5547-ac60-3986eaf78f68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:d37d4f56-e7cb-549f-94b3-89b2bc2f7854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:f18bdd4f-0786-5886-9d31-a0ab530d2fea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:b23f2def-a953-52da-9284-a99f2ff3d713", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:190aed31-007b-58a9-b90c-503777b6259c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:29cba3da-12dd-5a91-afa3-629bf211e1c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:83b2f159-58d9-5e70-8726-904f0b89b095", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:1953fe3a-df62-53d2-92b1-8447a1070188", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:6eea4c2a-cc1e-5829-b78a-1576a711cceb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:cf3e783b-47eb-5d00-9ac5-716c80adfee6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:8d57e6db-7e0a-5963-a521-427f3b9b82bf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.16-tuxcare.6 of @angular/core. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-68945. The vulnerability concerns HttpTransferCache's cache key generation logic that treats repeated HTTP parameters (`?role=user&role=admin`) and comma-separated values (`?role=user,admin`) as identical, causing cache key collisions. However, the HttpTransferCache feature does not exist in version 7.2.16\u2014it was introduced in Angular v16. While v7.2.1...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:9bdfb62a-aeec-55a2-a643-47d0b6ce0e58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:9bea577b-c8f4-5847-9774-e3b29f9aa9b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 7.2.16-tuxcare.6 of @angular/core, and is fixed in 7.2.16-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:1e8146e4-2125-58bb-a83e-f70af15214f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.16-tuxcare.6 of @angular/core. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88056. The vulnerability requires a String.prototype.trim() call on URLs during server-side rendering that strips Unicode whitespace characters, converting same-origin relative URLs into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 7.2.16. The CVE describes a vulnerability introduced in later Angular versi...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:3df02bbf-72e5-589e-9ca0-0c0d48f8ffb9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88057 does not affect version 7.2.16-tuxcare.6 of @angular/core. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88057. The vulnerability exists in the Ivy compiler's template pipeline (introduced in Angular 9+), which does not exist in this version. Angular 7.2.16 uses View Engine, where the SecurityContext determination for directive host bindings correctly uses the concrete host element name (`element.name`) rather than the directive's selector. The exploitati...", "justification": "code_not_present" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:1a13e8a6-01a9-5abd-8fe5-ae073ae7915b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.16-tuxcare.6 of @angular/core. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and client hydration features that were introduced in Angular v16+. Angular 7.2.16 predates these features by approximately 7 major versions. The codebase contains only legacy TransferState (manual key-value store) and NgModule-based HttpClient (no hierarchical delegation...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ], "bom-ref": "urn:uuid:d45563aa-6d20-52dd-81da-e0ace422bb88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 7.2.16-tuxcare.6 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@7.2.16-tuxcare.6" } ] }