{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c7ff27c5-35e4-521b-a347-41d2bb0d3356", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/elements", "purl": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1", "version": "17.3.12-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:71005fa3-48a8-5759-83f3-782217162bc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:1ef1d012-a96e-5fd4-bd19-31285ae02673", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:482925de-5eb3-5584-ad0f-e1a8f4bef58f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:776d622d-4fa7-5af8-8513-3c8615fb66b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:ecaf1cb5-2f80-5575-8303-b5cf699df7c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.9." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:0f02f65c-ee21-5651-80dd-56f746922fa4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32635 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.7." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:20d11713-3610-5a9d-888c-3f41f4a1807a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.12." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:9e2921f6-f786-5bff-992b-0c3e99040ca2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:047d2039-a575-5fc8-8872-a145cabbefcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:70f04fdf-a6ff-50f9-9f92-71d90ef3a5b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:7bc4de02-cea7-566c-9c55-5ab882769bed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:740d2dc8-979e-5bce-b883-c62904ed6798", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:4aa6f990-b5e1-5de0-8126-41de4aba5e0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:66fd97c0-cb01-5681-b257-27cf4fd72d54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:23e89425-4586-5cb8-9943-11a51d322269", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:180a59e4-b421-5813-bd45-9ca66d7afad1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:8f7c4ca8-3a83-5223-a104-68765dc545a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:0596b04c-7388-5a5d-b537-05a93bdc16a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:d3814f75-b882-5bfd-99d3-390da5802890", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:34763073-65dd-5674-89d6-d077552bc6fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:62456903-af16-52d0-92a4-61fe8c4b3e78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:20f3d533-83bd-5624-8d22-f3ad67c2a331", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:b827f172-0799-5f40-8bfd-448435a1eb93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:fa67ad91-ef60-5ce2-864f-4693422e3ef9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.3.12-tuxcare.1 of @angular/elements, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:717dc85a-f24e-5483-9354-2933d5b1a54d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.1 of @angular/elements. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:9dc166a6-0dd4-5712-945f-22ec20e90d5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:121f755c-9923-51bf-a55c-81a315c5e798", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:66ee82d8-2834-58da-9522-bd0fa67d396e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.1 of @angular/elements." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.1" } ] }