{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e6043d8d-4b2d-5143-9cb7-f44e26d83ec3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4", "version": "16.2.12-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:c535c374-0128-5fcc-9093-b2236e0293e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.4 of @angular/localize." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:7562cf16-f048-534a-b744-832d50974f9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.4 of @angular/localize." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:75f488d6-266a-52c1-a3b0-0b5f353b0be1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:6b4a1559-dedd-550b-8d15-696f5a357fa4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.6." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:00e40bd8-e566-5966-aca0-6fc3fdf15363", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.8." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:e909d632-5e56-5a90-b5db-5b5dc252c41e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.10." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:d174912e-8961-5c1f-93fb-5253716e414c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:09b5512a-4bf9-5a8c-b4ad-1f2d5b29788f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:5f86124d-deea-5d0d-8dcf-3b967547a2f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:64b20019-2fc3-555b-ae31-7491b6fbc513", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:c78c90f1-acd5-5d33-a144-e96a578d2fae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:0e04c665-16ad-5e10-bd0d-a8da93af4c26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:1fc5e6df-f254-5b4d-ab7a-dace851d9af1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:53a74a8d-5bd3-54a7-9f32-918aabfb5ab2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:2f6c2fd7-db5c-54bb-9f97-f3bc70ecc089", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:4259c898-ab7f-5081-b040-65d42e90ba55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:01d89642-46ef-5b88-b31a-fd72ab3b4f1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:56745a45-a7f9-591b-af42-e8b77c1605cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:038177fe-bb50-567d-8c8c-7bcba92a5868", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:099baea2-b82a-5d7c-bce9-7a33340ef3ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:9967307b-8c57-57a4-8f96-f021aadeedd9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:66623f18-472a-500a-bd13-801d4667f540", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:21f7a48b-520d-5483-a770-5143fe5f960f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.4 of @angular/localize, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:b51e78fe-0c91-57b2-b160-d945d51fea87", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.4 of @angular/localize. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:aaa31b13-41d1-5854-93ac-40d31c4f8220", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.4 of @angular/localize." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:1bfe8b1d-1df7-5464-9ff4-910738afbf8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.4 of @angular/localize." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ], "bom-ref": "urn:uuid:0919d1ab-1505-5243-9483-e0585c3d57c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.4 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@16.2.12-tuxcare.4" } ] }