{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0aba13f0-c2ee-52fd-8278-57c59464b721", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/elements", "purl": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6", "version": "12.2.17-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:39d4403a-83d0-5e8c-9be8-8d8988630a94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.8." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:c449015c-86c6-59c1-88fb-30484ea5926b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.6 of @angular/elements." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:34130caf-569c-501e-ad74-622edea0a6b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.6 of @angular/elements." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:9655a724-5e5b-5945-a597-e772b27b5e77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.6 of @angular/elements." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:7916247d-947c-59e1-98a9-b5b4f9134abb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.2.17-tuxcare.6 of @angular/elements." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:49636a70-f128-59ab-ba75-dfefbc32e4c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:e451be90-ad05-52c1-846c-0f659d77bd2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:a9deed19-54dc-5109-9b9d-8e3c7ecfc301", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:23b87cdb-8a05-5548-ad86-07cee844ee92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:6dc13df6-82c0-527a-8ecc-ad9b331e3f36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:39987c32-01fa-5c6f-bbf4-48ba586f997e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:10a5dfb4-a2bd-5a4f-a560-1519fb81dc10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:98174675-b0e0-5805-b045-cfddbd94d6e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:646ea4fb-cf47-543b-aa34-85d506ff1ca6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:92a94955-690c-5373-8f40-e4d081d0763c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:b2f7976c-cf9d-5b2f-a624-278840e24c41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:2cc447fa-490c-5ada-a0b6-51e7c3abdbf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:10f19be6-e417-580f-af5b-e20adf80c136", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:e88d8e77-4fdd-52a1-8d83-c82d652ae168", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:87723fdc-a419-5eb4-8ee2-65a2625fc0b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.6 of @angular/elements. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:9d6fbb5e-7cfc-547e-a035-76069c039e5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:e24668b0-d068-5c73-a1a4-b9c8f87546a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17-tuxcare.6 of @angular/elements, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:6dcec941-1028-52b2-910b-355105d26fab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.6 of @angular/elements." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:914a0ee2-f61e-526b-8325-34271b67ae47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.6 of @angular/elements." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:92245b3c-5601-5a9e-9a23-9d3b648e5a14", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.6 of @angular/elements. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ], "bom-ref": "urn:uuid:7f7cda2d-6618-5cb6-a73a-3c4c7700a99a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.6 of @angular/elements." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@12.2.17-tuxcare.6" } ] }