{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:aeb768bf-5807-5f94-ad77-17dca3ef97ed", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1", "version": "12.2.17-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:c5d8544d-a33c-5032-b798-717a22de8621", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.8." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:0b74051f-4b1d-5296-81b1-ea5ffbda8c51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.2." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:d57ad6fd-cdbf-5b6e-9327-5ebae677623b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.3." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:48cf0184-cf43-543f-b73f-7d6124230828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.4." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:6c18b4fa-2762-504e-9960-c88324474aa2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.6." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:27de96db-97fb-554e-8094-64da503e3868", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:2fca1966-99ce-5ade-9317-bd00bd0751c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:652f2e2a-6b60-5e82-9abd-48f63144a8f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:631a4986-5b46-540e-884a-0f4039638fad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:c85d15e8-b773-5bfe-883f-5a816b614144", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:5bffac41-4ad2-55c9-b631-23e860ee81c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:8f83fa86-9afb-5d2c-a566-f62422ef4c14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:f0dbce47-7256-51be-9aaf-b3b9e6a0e42e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:08e61002-7df5-5111-9c03-380abf84bf9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:0adecf98-503d-5e88-81b5-297f9a57da42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:9a1a10fe-4710-5eb9-bf18-98374ccd9545", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:2ca874f2-5ef1-503f-911c-38bd1527aec8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:995a3209-4db5-507a-8957-d82803f2ffcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:2e0872a0-7475-5b7e-a790-7ed4ad316315", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:3ca9b9e3-b9d9-5ab5-95db-f25e94291269", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.1 of @angular/localize. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:5d2e8277-e422-54fc-8263-e7241b79922c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:0207e23f-a706-5839-8ca2-0b884743fb8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17-tuxcare.1 of @angular/localize, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:4bbfc6fd-9880-565a-83a1-6f046cc713fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:cd6fbdea-40f1-5bf2-a20f-054bae86a7d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.1 of @angular/localize." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:f27bd72a-5998-5f5f-9b99-787273056205", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.1 of @angular/localize. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ], "bom-ref": "urn:uuid:0b5f901b-f63c-57e0-87e3-2ca0f32c29be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.1 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@12.2.17-tuxcare.1" } ] }