{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:713ab9e5-d740-5cb5-81a9-e351df71a437", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10", "version": "16.2.12-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:b8fc779d-e250-5752-b77b-62c505b1dbbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:aceb2101-f88c-503f-8f8b-397a86bc8563", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:cfc79870-6a74-5e7f-a0c4-3db145d2d3dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:f2581d94-6f35-5c9b-97b4-d237f29bf163", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:3eab83eb-ad3d-5c9e-b240-6955c24744ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:3e097f7c-fa08-5640-ae83-9d5cdafca219", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:d49fdb6a-c914-5695-857c-76280372b62e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:2fbfa0eb-21b2-597c-8b73-7c6ed2b47601", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:dbe7b54b-844c-5860-8ae6-ace922d2f899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:5ee5546d-23e6-5503-b36d-264ae3c787bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:1cdd4fae-a93d-52d7-9599-aea59d907941", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:5ff78f37-07aa-5cd7-a923-0087c7c59f4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:61552b21-db1f-5432-a201-5ed26579cd67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:6311ac99-e348-574d-abc5-e5dc508f3a7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:0500926a-7eaf-572f-bd55-c8a304370e33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:6f401b59-f44e-5a7a-8836-49432da0f327", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:e5b6b69a-bd11-5ef1-97c2-a16917ea3009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:087dcb3b-b68b-580a-8e0b-5b7adc6c567b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:faaa2450-a450-5ca9-836c-033a7e85f892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:ea044c65-3cfa-59db-b364-ab73a60a7592", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:a5600464-65a0-5fbe-b7cf-b26cd385c0ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:7356b638-a955-5fa6-9102-2409a2f1c1d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:3c25237c-15a8-5bb1-b6cc-2b825adc4576", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.10 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:0e186b97-c6de-53ca-836c-cdf4e2b65b06", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.10 of @angular/upgrade. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:227860a1-cec5-5296-832a-9065dcd7fee7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:97c2b3d3-afde-5b4d-b4c5-3663ca019887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.10 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ], "bom-ref": "urn:uuid:36bcb70b-3f69-5b46-91ac-9ab9e7746b3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.10 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.10" } ] }