{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a9f7cbb0-c6b5-56f1-a0df-83796ff1440b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11", "version": "16.2.12-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:ed4e0f06-8b2e-5bcc-bec4-2fc5896c3a75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b34ef0b0-4f30-5bd9-aaaf-ea6863b63f5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:8c9a4c43-ad29-50b4-ab0a-b19cb3f1f11d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:bfa01227-5390-525a-ba2f-a451a28d37cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:0f58c44d-0d53-51dc-818a-950e27faee0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:1efee11f-1cd6-5b4f-bb7d-2d5481c309f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:e3fa2bf5-6438-5faa-9da7-7441e53456fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:e13cb81f-bc15-531c-9ec8-8c665f1e439c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:18628329-5944-52a9-ab3f-47a97f00ff5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:af371683-352b-5b73-9641-2d1daf18c0f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:f62576b1-dfec-5d8a-a533-aa59dad91601", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:cc48cbf1-6fe8-5333-8d08-6b12ccc66c14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:d08fbad0-85d1-5490-bb35-82c2deaabb5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:166c2637-5ce2-5263-8878-caa4c993f1ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:10d1f431-6fa6-52ff-bbc1-42428b745bdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:2ec01235-1f82-53c3-ac21-642b5739cada", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:a6f86247-9605-531c-9876-f31f2f623453", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b494a6b4-d3f6-5b9c-8d63-0c7132d5e362", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b9e45053-86cb-5ef5-9164-53c81b1189eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:0ed56d98-2c28-557d-8eac-f6077b42280a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:db778849-3a7a-5c62-bbd1-400ed41c7c46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.11 of @angular/localize, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:d292f605-fb1f-5db7-a008-6a2a51a8ce1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.11 of @angular/localize, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:764492a1-eb48-50d4-873d-fb43dbcefb21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.11 of @angular/localize, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:34ff45fc-e097-52d7-8245-384eade7847a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.11 of @angular/localize. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:934e3e12-7f37-5d86-8593-9196b73a7474", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:e31cb3d8-38cd-570a-b0ed-715743ab5d58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.11 of @angular/localize." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:7b7b6321-7921-568e-a22a-011ffdc986ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.11 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.11" } ] }