{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:274fec97-4cba-50f9-a980-f43ba0c42af5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7", "version": "12.2.17-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:7695fb4a-87ac-5b9b-8cf3-ed9de73289cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 12.2.17-tuxcare.7 of @angular/upgrade, and is fixed in 12.2.17-tuxcare.8." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:b8dfb651-5e6a-5b99-ad36-cd3e2dd1d37c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:c5ff1041-a6ca-5cd4-b4a5-4d34a1cb06eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:b985dffd-97d1-5857-83ca-c40056d7ff0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:7db8be84-557c-5f73-9266-b14bf883f6ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:fe9836c1-941a-59f4-804e-af9f0b0fe513", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:ac1df63b-2472-599a-8ad6-1dd0acab1584", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:2e7aa38f-7714-5bcc-ab2b-f1e6158a423e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:52443732-0ca5-507f-854b-08ef7dd267b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:22a891f5-c211-5853-8dc6-06e48a04685e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:22965fd1-5007-5040-aa23-ea32dc295222", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:c1aa37b2-93c1-5a59-af73-6f3b3ebf4a59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:e8a16a21-c77b-5307-a2e3-86a5df402926", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:a959877e-b16f-5fd6-9de6-386c5f87ba33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:79182832-41aa-5c61-9596-ba1c0bf85c98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:31d5872e-09e8-5d69-bb25-7a263a1e245e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:81f9c69f-51ee-5068-8166-03551aa57c94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:9bb5be59-56a9-524f-adf9-9f62ee2d9967", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:f9dca3c0-975f-54d2-81ed-42e3bace16b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:d890e5c0-4b9a-5cb7-b405-853ea6ceae76", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.7 of @angular/upgrade. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:51258c7d-4955-50b2-bf79-29113ce06be8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17-tuxcare.7 of @angular/upgrade, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:5efcc685-783d-5d74-9699-2dd9330509ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17-tuxcare.7 of @angular/upgrade, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:b44daf25-b73f-53bb-b101-df2bf0e8bbd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:0ff34848-482e-5b9b-b506-150e55907b09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:81cc41e8-7d46-5759-8e03-e40bcdcdf558", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.7 of @angular/upgrade. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ], "bom-ref": "urn:uuid:593c4b38-8095-55dc-8187-347076989ee9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.7 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@12.2.17-tuxcare.7" } ] }