{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bc3b96b7-5146-5a2b-a758-6b0d17e2e9e6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7", "version": "16.2.12-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:de1f7001-679c-5c8a-854c-ecd763aa8028", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:7c5c0df3-427d-5573-add9-074d150322c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:4f9506ea-2b70-5c9e-b809-7ab1e9ad7928", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:9f1046a7-2b63-5732-b8cd-1f1a177a11d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:e01b2423-a239-5634-8285-27ce0b1e21d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.8." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:40e57001-5b70-5da4-994d-859692bf76f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.10." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:c07a4f1a-3617-5eb2-928d-33be814bccda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:9f74d65a-5c3f-5264-acb8-2ad405282ab5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:ee7dfd13-e7a5-557b-acdc-434b96e2ffb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:c678998b-a8e4-50e6-9c7b-ad459bc4a71b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:3a48f479-0f33-5afc-8372-f9398ee832e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:7099a7ec-7fdf-558d-baed-179db8081a22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:5ce6523a-13a3-5ca8-9854-84d095fdc706", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:bf26fcbe-7afd-5c74-9027-a9deae58be5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:09c0f9a8-ea09-5370-aee9-ee28ee5b24de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:c0d19715-59c6-57a1-90d9-0f0d3d9d0b44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:be781d42-0ff1-5f79-b557-76ae6a15fb96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:3e6cea68-fcad-5ad6-9241-61f35d3ac367", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:4cded192-4a81-5705-abfc-e7dfa4ff5a80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:388ec1bb-2794-590c-9bb2-d0412481f866", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:67e656bf-d1dd-55ad-9b86-91fcba97884e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:a16d495c-ab2c-5575-84b4-5912d8c3c501", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:e003fc13-dfdc-52dd-b2d9-21c2efd2ecbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.7 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:5d707a7c-897e-5f05-9d67-6728efd3b410", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.7 of @angular/upgrade. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:347d053b-4fe9-5ce6-a0e8-ec4f8e938677", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:48f63863-9b3a-59e8-a491-52efc9b822d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ], "bom-ref": "urn:uuid:d82bf884-7719-5abd-8497-088061d3913d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.7 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.7" } ] }