{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:953901a9-a761-58d6-87ca-02eadc2bf764", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3", "version": "16.2.11-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:8bda8969-8f07-56c8-a311-89a4fa519178", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:02c65d9a-ef17-578c-99e8-49b4a2939eb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:8e064189-69f2-56fb-bc5e-8f63baba2071", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:cf4cc917-d0a1-553f-ba78-edc918792e5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:fddf3bd0-5157-5df3-a958-07f075c3d44b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:2f609876-1956-5cc2-8c63-59211ee8988e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:84d137cc-caed-52b3-8650-9cb6572e5e6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:a7f7e8fc-8ba7-5e41-a9d0-6385268dfd3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:a40adac5-1b30-550d-9bd6-416b2d564506", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:32c141d4-3d9c-5cd3-92f8-29dff1ef4af5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:2ccb2511-23ac-5976-8f4b-7b714458b761", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:7f551962-ebec-5ac9-91ed-72378a26ead0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:a7d41eb8-3cac-54ce-8505-645d788f8c76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:22429504-5fee-5886-8467-45bfb1927447", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:b7e72ca8-1de7-5904-b636-9a44f8129b17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:8338186f-bb98-5204-8298-35c22c0ae07b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:279b1b01-eede-5938-8365-d22d21db87cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:a3a37e48-9d02-567a-b3a0-9c90d4482f4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:e7c45686-a8d1-52a2-ba31-2f46505c8c97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:932de497-9d18-5391-822f-3fe9dc0573bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:97980450-29a9-5e2b-b35e-b2209b70c7fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:1ff47c38-23a4-50ef-89ea-d48d9125121b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:416e77c9-13a9-5c56-b279-81381cbbb91d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:dcecafdf-2571-59f7-8967-11ac328a7e7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:72517133-e97e-5d0d-b9bb-3af5971baafb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.3 of @angular/upgrade. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:4122908c-7c46-54d4-b5af-19d5e3468a3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:747e45ec-3a29-5117-bd47-136fd7d85030", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.11-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:e302e0e2-8e95-522b-8063-951c3eb9d02c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.11-tuxcare.3 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.3" } ] }