{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:aea0c8e1-d3b0-5f5d-bc60-9ec7bb66c315",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/language-service",
      "purl": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7",
      "version": "16.2.12-tuxcare.7",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-59052",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:3fd5c4df-86ab-5579-aa0a-ca4109607cab",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.7 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9e5b22b2-da05-50be-a55a-4b56d08ccf0f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.7 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2025-66412",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e995fa06-783e-5cff-9981-d769c4e56a0d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.7 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-22610",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a5320931-13ca-5b29-818c-7df7cbd31576",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.7 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-27970",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:599f515c-98e1-5470-8f9b-f4255b060a0d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-27970 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.8."
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d770737d-4ada-5be8-8905-dc7ed140de1e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.10."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ca6ecb18-ab44-5775-bd8f-56e70f798a5b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9701999c-5061-50b6-8d29-ecf5a2ed2c80",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2ce58a42-c262-5d7a-bd52-6bd702273606",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:cdafdec6-b6f7-5092-a19d-a7c4dd2b7a06",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:05b3a24b-eeb3-5caf-aa3f-15d1ae9b8a59",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9cf12a43-25ce-5e9b-a1f8-02c54f9c5c11",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d1df13ae-25ba-5e4a-99d8-1ce683d04993",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50557",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:6c0ecbfe-9b09-5de0-91e6-af662693250b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-52725",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:47a58d74-838a-5ee5-8e30-54069601dfde",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ad8f9154-b6e3-5301-9d87-121b756b1c54",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54265",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8ecefa1b-abc8-5cf7-a22c-22ce986ac67c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9a3e2ed9-1914-583e-9ac0-0da17c245079",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54267",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:31ba5947-790f-5366-8ae5-bee96f68318d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fd07955c-ee50-52b5-938f-fa6a524c86b6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:4a64abb8-bf1d-5110-beea-49bafeb8d411",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.12."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:46029618-e60a-53c4-956e-5389747b92b3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.12."
      }
    },
    {
      "id": "CVE-2026-69151",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e2207ef7-a498-5dd2-992d-07c053448f5a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.7 of @angular/language-service, and is fixed in 16.2.12-tuxcare.12."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9dc0a654-e01c-52ef-9162-0e83eabf2989",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.7 of @angular/language-service. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88057",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:3f04580d-fbe3-5d8c-a1a9-48259de8d1bb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.7 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:93a46659-f307-5ea8-b6e4-27b2403bdd2b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.7 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:32b2911c-4dad-521f-bbb7-c52f32eac7ad",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.7 of @angular/language-service."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.7"
    }
  ]
}