{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a9db4e70-6696-5445-8aaa-461606b6fa93", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/elements", "purl": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1", "version": "7.2.0-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:6de28a59-a424-5110-8de5-2b146345617c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:149d700f-5ac6-5571-9ce3-89236157b8a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 7.2.0-tuxcare.1 of @angular/elements, and is fixed in 7.2.0-tuxcare.2." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:3d5e1138-136b-5196-8dcc-64a79b2855ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:68049d0d-e87b-54bf-bcaa-934498df9eb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:3e6319ef-297c-5734-b7ce-89ef7a620ea4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:afb21a2c-8bce-5a3c-be2e-539f720322ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:ae01cc58-5468-5c21-ac56-f90ee8cc4456", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:89a2eba0-4a97-5293-8662-67ca7d7199e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:af2301a2-6106-5180-bea2-91d341f447b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:7e06f728-8b84-5bd4-9f93-4d1d96c6f324", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:12946620-959e-57ff-8518-57e10214b40f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:40836a03-6786-5c06-9071-7aa8421b65f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:8530db57-c556-56be-9c3a-8fbf0c78a904", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:20adcdb5-924d-507e-a637-215ba90eb2b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:25c5e1ed-f350-57a6-9ad5-8e306a626e73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:a54e77b7-f675-5a41-8c87-c62650f58e10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:4aa2267a-3f10-5113-96b8-971ebf893648", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:d4f0ba5a-3c24-5380-87e3-0d2f2ea2cade", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:56942daf-4c94-5221-b082-b7950014ba11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:584f65c3-fdca-5835-969e-4a7ae53f85b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:9f823ef4-ff8f-5789-ab85-1b63da5f5f24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:1798cf13-4907-54e1-bf36-e589c7bca29a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.0-tuxcare.1 of @angular/elements. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable component (HttpTransferCache) does not exist in this version. According to patch documentation in the repository (CVE-2026-50170.patch, CVE-2026-54266.patch), the HTTP transfer-cache and client hydration features were introduced in Angular v16. Angular v7.2.0 predates this feature by many major versions. Exhaustive searches confir...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:909e7f3c-1255-5636-a0ec-c223314f6f26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 7.2.0-tuxcare.1 of @angular/elements, and is fixed in 7.2.0-tuxcare.3." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:9b27cea6-50ff-55ab-9638-963a007a4755", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 7.2.0-tuxcare.1 of @angular/elements, and is fixed in 7.2.0-tuxcare.3." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:5a799f91-123a-5471-8f97-4a4197ed2d81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.0-tuxcare.1 of @angular/elements. not_affected \u2014 Angular version 7.2.0 is not affected by CVE-2026-88056. The vulnerability requires the presence of a `parseUrl` function in `packages/platform-server/src/url.ts` that uses `String.prototype.trim()` to normalize URLs, which strips Unicode whitespace and can convert validated same-origin relative URLs into cross-origin protocol-relative URLs. Version 7.2.0 does not contain the `url.ts` file; it ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:82a29fa3-dee1-5df1-bec6-4666a82cc44f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 7.2.0-tuxcare.1 of @angular/elements." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:adc31675-71e0-540a-a3d5-d95845434b84", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.0-tuxcare.1 of @angular/elements. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, hierarchical HttpClient delegation (withRequestsMadeViaParent()), and automatic HTTP response caching features that were introduced in Angular v16+. Version 7.2.0 uses NgModule-based configuration (HttpClientModule) with manual TransferState only\u2014no automatic HTTP-to-TransferState caching exists. The...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:237d1850-62f2-5dae-ae6d-f3bc9f34980c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 7.2.0-tuxcare.1 of @angular/elements." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@7.2.0-tuxcare.1" } ] }