{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e68734c7-7e3f-5b81-b70c-8b8fa3238323", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@16.2.12-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11", "version": "16.2.12-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:ea1d4b37-3050-5cc5-9c5b-b6a89efe458d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:fe93acaf-aebe-5082-9264-582d26923081", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b8ac7c9a-8172-5a73-bd6c-60e18f8fca55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:0a48ede7-b57f-52c7-b989-af2e834a1781", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:3643ce46-e96b-5677-a52f-cc959131eaa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:0d39725c-c0b0-5de7-9942-71b42cc924fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:ab5a39a1-9ce4-5d11-b309-851695f48df0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:3dcaaaaa-a0d6-511e-bf7a-1bfdd320d0ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:09835cf4-3c46-57c4-965f-5796ea1d463b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:bac38c95-8a68-5f07-875e-bdae3361f90e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:d206b3db-8da0-5255-87c1-1810d538fffc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:d80122c3-d11d-5b24-888c-4dd3b7c6d7b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:ac32789a-c533-5cbf-a8e2-43f482cecee9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:8088a133-0f61-5053-aa66-92f9a864e3e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:91c550cd-ac4b-5ffb-b92d-31d0f485ed8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:0ff0c425-0c53-533e-920a-98117a10ab42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:b92b0520-5ea7-52dd-96e6-fa2409987703", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:ded46a4e-8594-53fe-b933-d60c54232ac0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:fb097428-33b0-50e2-b603-d0c29cbf2887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:156dd036-2647-514d-ac10-2fb5efa7e31e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:242bd979-0209-5f58-b351-e30ffcec9da4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.11 of @angular/router, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:36938361-9f53-5e2b-9609-3d7123bb7f7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.11 of @angular/router, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:1211de76-7908-5dc7-971b-97643e691c6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.11 of @angular/router, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:53a65642-7d65-59e7-b881-0507b8a80e22", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.11 of @angular/router. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:55b3a38f-e942-50df-a0a2-c2d47211e376", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:a1b8aae4-8384-545e-b2e3-758fc7760e9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.11 of @angular/router." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ], "bom-ref": "urn:uuid:1e8e11e9-cc89-56d6-b6b9-78e6f91efc91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.11 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.11" } ] }