{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:59a086b6-21f7-5c75-a4f2-5064ed2a8769", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/elements", "purl": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2", "version": "7.2.16-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:e7f2b86b-0391-5b3f-ae2d-a9ba7a06f1f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-4231 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.4." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:9c8cc22b-039f-5667-abd7-057deff2e716", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:2230d641-8e31-5ab0-8a6a-81432b5ad7b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.4." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:5078b1ca-813c-5818-b5d0-b143aabe4eb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.3." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:ade837f8-640c-58ad-9fb2-155d993edf45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:55ee3c64-737e-573e-a06d-46908e17f34c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:397c6431-719b-514a-bc51-97f65f910301", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:c42af24e-6b78-5600-9d2c-e2ee8d5b33e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:430ba5ed-668b-5d86-8bc7-b60ce2344d7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:b2edd524-c871-5539-a997-6d550f992574", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:39b79fca-c7fb-5b05-b08e-ee203d510a4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:d3bde149-b48f-5de4-92ed-98e3a97a710d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:0fdff294-ca31-54c0-ba84-3a8f35d36ac1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:2b33d582-936f-53f5-9486-0652bfbbe4ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:418dc8cb-7010-5ee2-85a4-42fa329f7ab6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:11d26c0f-caa6-59a6-bb9d-25f231e87358", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:877a21f2-cc59-5089-a76a-f268ed959dc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:b8e0abf4-9e5a-5cfb-8a15-cdeb311161c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:d34baad3-4eec-5827-b944-79c0415aaf2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:e46a7fa8-1a96-5e14-85aa-f6dbd77208f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:a9e719b1-eca7-5a0e-a841-d3d7c92120ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.16-tuxcare.2 of @angular/elements. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-68945. The vulnerability concerns HttpTransferCache's cache key generation logic that treats repeated HTTP parameters (`?role=user&role=admin`) and comma-separated values (`?role=user,admin`) as identical, causing cache key collisions. However, the HttpTransferCache feature does not exist in version 7.2.16\u2014it was introduced in Angular v16. While v7.2.1...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:988fe6fb-88db-58c9-b6c7-474270ae6766", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:34458fc8-9b33-5fa7-a0cf-b7e6368911e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 7.2.16-tuxcare.2 of @angular/elements, and is fixed in 7.2.16-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:53c8f8e0-7c47-5129-87b7-fa25603ee72c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.16-tuxcare.2 of @angular/elements. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88056. The vulnerability requires a String.prototype.trim() call on URLs during server-side rendering that strips Unicode whitespace characters, converting same-origin relative URLs into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 7.2.16. The CVE describes a vulnerability introduced in later Angular versi...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:49b6384f-5df5-5374-864d-b0ee5d0e93ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88057 does not affect version 7.2.16-tuxcare.2 of @angular/elements. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88057. The vulnerability exists in the Ivy compiler's template pipeline (introduced in Angular 9+), which does not exist in this version. Angular 7.2.16 uses View Engine, where the SecurityContext determination for directive host bindings correctly uses the concrete host element name (`element.name`) rather than the directive's selector. The exploitati...", "justification": "code_not_present" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:cb4ada76-bb17-52b6-8a7c-00b2d9f098d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.16-tuxcare.2 of @angular/elements. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and client hydration features that were introduced in Angular v16+. Angular 7.2.16 predates these features by approximately 7 major versions. The codebase contains only legacy TransferState (manual key-value store) and NgModule-based HttpClient (no hierarchical delegation...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ], "bom-ref": "urn:uuid:9658bc7f-33f2-5c91-bab8-b7460670d035", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 7.2.16-tuxcare.2 of @angular/elements." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@7.2.16-tuxcare.2" } ] }