{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ad49c331-e988-55c9-a020-2014f244c45c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2", "version": "16.2.12-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:5619d4ac-75db-5b51-a7cd-296d0e4dbcfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.2 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:b6302080-1ead-5991-8d7c-be4c7932f4e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.2 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:5a233015-a6fb-5c5a-b52b-7cc44bda1df7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:37835ee4-6146-5954-91dc-d57e30a4df3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.6." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:3908ad0b-e529-5142-89b3-86c8c8511fc5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.8." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:3614fa97-218c-577f-af37-3c5d60e9f2de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.10." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:fce61574-76ba-5654-a407-91562d5ffc79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:9e0f9008-3501-5b0b-822e-1c5522d38718", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:0ce7a592-5d8d-5581-bf2e-4f8dc3766eb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:66cc78e4-df71-535f-9850-239afac53740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:e5193732-5ed9-543f-9f4b-feb0a7aa1192", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:3a24cbcc-5dd6-5ba6-960c-1d98bccd410a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:5e258d77-547b-56b5-85a8-4b8f1b176897", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:56ffbed6-28db-5d57-b62c-f0c33aa9b36b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:eb8ddc5d-5968-56f4-9c48-d3bd6f5833a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:3eabd794-6935-5e89-9209-4326864f21bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:1f7160d3-402b-5eb3-b127-5843512169a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:d025a6d3-26e9-5240-9d6b-06f893899556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:67c2bec3-a24b-553b-9ef9-242f93edab4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:541bb131-2502-566a-858c-4295364e753a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:de248a38-e341-5382-a9a2-41e2e120d44a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:434ba531-fc29-5475-86fa-9472125755d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:c6e9ae4e-737e-5251-ac82-cffb801c9847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.2 of @angular/language-service, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:a925aede-36e1-5777-b2fe-21aead44fbcf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.2 of @angular/language-service. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:ae82d9a3-e9de-5fdd-bdd1-1cae51d08100", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.2 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:5843b803-f62f-5eac-8883-06d9039cacc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.2 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ], "bom-ref": "urn:uuid:7fe6f778-7000-5194-bdf9-dce2488842ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.2 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.2" } ] }