{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:15135bd7-3ec0-5af1-adbd-0588216c3ae8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/elements", "purl": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9", "version": "17.3.12-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:58dce8a3-60a3-57ca-a9dc-16c6a193c6ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.9 of @angular/elements." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:0df9b715-74b3-5b4b-936e-10387dc95137", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.9 of @angular/elements." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:46e35489-9dce-509d-8003-0b567ac49639", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.9 of @angular/elements." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:182564e4-7958-5f76-a612-7240ee3c0ee7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.9 of @angular/elements." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:03c86528-c711-52a9-b958-b6cdce8d9eb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.9 of @angular/elements." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:e11971df-46e6-55af-9125-bddb83dc1bf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.9 of @angular/elements." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:ae032055-cb31-550b-bc75-0447de4d99d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.12." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:85eac199-6cac-5741-b925-5084eff2fe72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:c7203d3c-c717-5396-82ef-83c903cfdc1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:13305448-0ad7-5319-98df-cd73febde972", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:ef3460b0-4345-54d8-b7e6-1ec6c0e7231a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:4350fcf9-a3d5-5042-b856-686eec06b756", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:6662d95f-aaa4-5a8c-9357-77c9f99d5afa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:5f31cec6-cc37-569f-851f-249a471154c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:0b0163f3-6f51-52de-a046-7defe936803b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:4f01d6b7-d59c-55f4-b381-fd3bda7a9a46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:0973c863-f79f-5289-b8b4-45c563db8935", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:77212cae-60ee-5bf7-9df9-3d8a8d01800a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:bee88241-93ce-55f3-b272-41db2d7b12f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:c3349768-2ebf-5cfe-8c84-58b27e8d44a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:d518f08d-bd97-5879-8182-6865d087a4e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:d4023fe5-4560-5ae1-a666-8058a27ca06d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:6a11d5eb-fdd7-57cc-9038-084e002325d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:3553fbdb-565d-58df-8db7-5ac43fab4bff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.3.12-tuxcare.9 of @angular/elements, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:be898d95-5d86-5c9d-8612-d07ec373ea0f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.9 of @angular/elements. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:35722a0d-618f-5c93-ac1a-3e78c52dbe78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.9 of @angular/elements." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:82efc00e-dddd-5e0a-a3d7-05e6cc04666d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.9 of @angular/elements." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ], "bom-ref": "urn:uuid:6e5dc9cc-7a0d-5bc7-a17f-9b6596f6683f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.9 of @angular/elements." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.9" } ] }