{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:493ae009-b98e-52c8-a463-8120518d0789",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/router",
      "purl": "pkg:npm/%40angular/router@16.2.12-tuxcare.8",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8",
      "version": "16.2.12-tuxcare.8",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-59052",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4dda1a97-7340-52b6-8abb-1310615ad96b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.8 of @angular/router."
      }
    },
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:dcd6c270-7277-5160-9eb6-3bd9698ec46f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.8 of @angular/router."
      }
    },
    {
      "id": "CVE-2025-66412",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9e71055e-3f72-5471-972e-ccfdd3f559b8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.8 of @angular/router."
      }
    },
    {
      "id": "CVE-2026-22610",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:017285e3-ac8e-5752-b268-9a2d93cefab9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.8 of @angular/router."
      }
    },
    {
      "id": "CVE-2026-27970",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c574a954-5ab7-5d6a-905d-e500c0af8186",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.8 of @angular/router."
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4c44672d-ff4a-56b9-837c-b709cf2cd516",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.10."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:71afe0aa-8a74-5d26-801b-7175ac511643",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:ff0d88fc-c2f4-5477-b24d-6683ca41f9b8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:bb8cfc2c-33c7-5f40-a5f1-1a0ec49a84dc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:adf7104b-bed1-5f8b-8632-8dc002919d0e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:da70a689-6981-5922-a676-7e79facf4e61",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:16e2bd54-301d-5ec7-ba47-c949fd14bbec",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:57c48c90-1b96-5935-9e28-8ca87c212ed9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50557",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:99dee1bb-3e01-5715-b0eb-95455ddf5086",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-52725",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c64efc77-5563-5d9d-aa09-22ad27415bd1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:47782a98-2590-56dd-a062-abc116ed4382",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54265",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:26e429e4-47d0-5418-aea9-4af6c417cf96",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:e2bf491b-12ff-5a59-9e0d-1460d46cdef9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54267",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:3140b0fc-083a-5cae-a25a-aa18772a54a4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:ee34fecb-988d-5d61-af62-c1c25f7bc086",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:3219949f-74a6-55d1-af4c-5439c9f28c79",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.12."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:1768efdb-dd47-56fa-9de0-c5582a452de5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.12."
      }
    },
    {
      "id": "CVE-2026-69151",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d897b632-70d2-5bba-80cc-e9536f861a83",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.8 of @angular/router, and is fixed in 16.2.12-tuxcare.12."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:59dbc61b-8ffd-574f-b8ee-4c5fbb28da9f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.8 of @angular/router. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88057",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4ed25bcf-d998-570f-a8f7-894395da1137",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.8 of @angular/router."
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:bbd87be1-1fe8-5538-8b99-27faa1946be6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.8 of @angular/router."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:82497db0-f637-5451-8738-ee7d68639248",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.8 of @angular/router."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/router@16.2.12-tuxcare.8"
    }
  ]
}