{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3b11d705-a0be-5d78-9394-1fd636a3e0e0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10", "version": "12.2.17-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:8c657b7f-a020-5634-9f02-7a5f79bdd689", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:f83150d2-5595-583c-b4c4-b10632667eaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:b62994db-07c8-5d6b-9c87-47bfbafff70f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:a0a97c6b-4e01-5ccf-88f5-7970d821b0ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:cdb4bc15-2614-5c71-a573-7985e1de534b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:c0b37f1b-04b9-59bd-bfc5-5bdd6cbbd1cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:3ddc42dc-f2e7-5e94-a9ce-883b484a90e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:1a175494-1b71-57a7-918d-91f082d21232", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:e107101b-1cf6-5d4c-8db1-0bc521bde644", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:24a3ff16-5b61-5502-9064-9af7a562aafa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:01e81065-3a50-5959-87b1-7debf581689c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:f543c1b0-fb9a-54e5-8a49-03f56e9c3313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:e7f28766-e5ed-5b1e-a7c5-a7e19db3b811", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:8f5f974b-2c5c-58b1-a5c6-e9c15f542b5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:6f40ca2f-25e8-5b16-a95d-962362acbccf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:ab463c5c-bfd1-5ff3-af48-d92ea0f3b5ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:6ec0dda9-4e15-538f-9dfd-1ebf61b04870", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:069b4509-5662-5279-99a9-be0028da0f07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:f1e5a281-bdc1-5c3c-8499-1c3e2eddc68e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:80224f22-f225-51a2-bbad-7fa7b14a54e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.10 of @angular/upgrade. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:354d1ffb-a097-5680-be1f-feba3ac43d76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:ed5552ea-60bd-5784-b267-7dde029e4951", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:87d540b7-10cd-594a-ab21-af545d3eb808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:e43733f4-fffe-5aa1-8caa-339cd72ed978", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:0ccba8e0-3aa0-561a-8d2b-452008bcc4c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.10 of @angular/upgrade. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ], "bom-ref": "urn:uuid:88bbe8a6-df56-56d4-9869-9424792a63d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.10 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.10" } ] }