{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:56bdb70e-beb2-5127-b02a-f00f595bb6ec", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/animations", "purl": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d7a1e18c-064c-56c1-a610-031ff4ba5e42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:60d7ab4b-72dd-5149-a8df-bc6c3f007007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:74799602-d5c7-52ce-a1d5-6b25e9e93cbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:37b9ba4f-c98b-5967-b83f-cde4160be566", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:35c6fd53-b545-5548-a9f7-5821fd207cf5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:11ed48a3-1087-5b67-a455-87516c6c00d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c2faed2c-5c66-5148-941c-7c705a81a4c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:bb18ec08-92ca-5d1b-9a7e-37c95d791984", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ca19aca8-4227-54f2-98ad-42dda6400ebf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5125b257-cd98-5176-b7fd-a3212f8ab3e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c0bf19ea-42b8-5a04-bf93-49706930b596", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:4a6ecc5f-a97a-5b4e-ba1b-2f69aafaecb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:1ed62875-fd73-5aad-9bae-68bbe4b402e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5bce7028-9edf-5164-ab98-f769539fe740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:4be8a983-68f0-54f2-b6b6-33ac217315d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:61f23fb6-b1b7-5f1c-8e8e-9c213bff315f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a2aa8ac3-aa01-54e1-b5b7-0002b16ecd9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e4c0d20f-b0ec-5cbb-b54b-00c5a3ac3225", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:7eeb8bac-5c83-50a8-9fc8-33a6ed249e9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e01c22d5-dc5e-53dd-8a2d-c3d87ed83e1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:129c7545-32b5-57f4-80e2-400546655321", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:34a99f17-8802-54bf-999e-99ae8cff276e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:70d6d3ff-b934-5bd6-b493-93753430fd23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e1a57973-e76e-544c-a198-a3ad3dbc8dfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ce585ce4-8919-5233-971e-e17360732716", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:00d924e9-0215-5c9a-a27c-4574be4c599c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/animations. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a4c20900-395b-5739-af55-89451836df76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e1bc415c-4f5f-5f07-9f62-1025a01d463c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:da824836-972d-5219-b4cf-c8bb9e58fe01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:6da92bfd-e98d-5c31-b0da-30c4b2e398ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/animations." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/animations@16.2.11-tuxcare.4" } ] }