{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2f9fa2fa-0e22-56b8-ad7c-5a944d40f4d1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/elements", "purl": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11", "version": "16.2.12-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:a501fdee-f12d-517b-a9d6-dd33a00f2b3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:211d349b-c751-5f56-92d6-d1583fe8a5a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:258b3964-d9dd-5892-9130-8f8a94ea5b96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:9d96382c-fdbe-59d7-9042-cd911c2b542a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:4dc826dd-02f5-575c-a120-1eb653a401d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:71ebe4dd-7f3f-5751-b96a-337d1b4868db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b63d7760-e815-56d5-94fb-ebf866c27f97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:990cd67d-bc66-5674-ba86-abae64abf8da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:fcbf96e1-a2e6-5a5b-bc38-aa7d9b94a17b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:868b2332-0f6c-524b-a215-ff706344316e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:ac585695-0782-5a8a-bf2b-a67ecd4cfb46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:f3368fac-9026-55ff-97a5-83bdccd4e8de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:2edf99a1-1872-59eb-9ad8-43a15b958335", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:3d1e69f6-945c-5365-91f9-da7c46cc72b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:268d681a-6d53-503d-a1c9-e7215168cc6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:6f53ef3f-9977-5af6-951f-d049ccefd516", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:4e090922-f270-557e-ae80-0a562a0b589f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:dd711a50-f660-5280-ab5c-5116bc6995ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:44a07ae1-c15c-5d3c-97ad-43824a6cd87a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:ba56bdc7-59d0-59f2-aac1-6a103b638247", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:fdcff9dc-3e86-5616-90be-75e7fe1400c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.11 of @angular/elements, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:458b2ed1-8ce0-51b5-8c85-27d42e189ff1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.11 of @angular/elements, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:365e0da4-5ac3-5856-9a7a-f0b5b1049070", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.11 of @angular/elements, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:a382bb2e-0142-512c-832c-f85ca5cfb1ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.11 of @angular/elements. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:dcf51563-1407-5ded-a1c8-5f8be7338419", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:563b729a-a390-5d44-96df-d3bb19dac41d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.11 of @angular/elements." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:c2738f66-dda6-5e0b-a8ff-e6cfcab652c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.11 of @angular/elements." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@16.2.12-tuxcare.11" } ] }