{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:04879c46-6621-50d3-ae18-a58f534d2d25", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:408d3f73-2d6a-56bb-a831-860aa8baaf0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:30446229-d16a-54db-8ee5-a84ac67402f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:26d01537-a83a-5d06-adee-b17733fb4f79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:4502400c-8656-5dce-a06c-665e5a31d3aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c010c33f-1df5-5202-a9a4-5cba3b460c56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e1963ea5-af2a-5be8-b7fe-38fcbd2a21ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:26d99511-6b70-560b-8d8b-77aa1a7b7ead", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f989f6b5-1c96-5e46-803d-694a03dd7b33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:26baaf1b-fa0a-599e-951f-e60ce2f72b33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2c8c8c36-3ba7-51fa-ab03-1085bba7be8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ffe13d6b-c063-5aeb-9a05-fbaef1e0ca6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:957a2e91-dd6c-530b-8484-5e10146e1ca5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c85fbb00-d486-5b9f-84f1-f02babb97b2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:6778e46e-7d57-506e-bdb6-7c44ea94411b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:1352a8a9-8ab4-5569-862a-774c5bc12131", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:df0b052b-6f28-53ff-8ec5-f9ace46ee6eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:98abcc23-7aff-51c4-b845-7f77c8980d06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:0309bfb7-ed94-5e4b-a7a1-5fee68461512", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:b9beb4e5-e681-5c0c-b5d5-9ff2b293fdf3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:fd8271f8-cb4c-5cef-a8d5-41748b913d82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:9324a2a7-b5b0-56d0-a95f-9cd0987f6c46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:0ece0178-5efd-5cda-afa6-d6bf4a9e15a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5d1d9807-fcdf-59f6-8f7f-a3edbaaff8cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:3d48a91d-1743-5180-b5e4-6d8b4d561cab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c76f4316-75cb-5609-a61d-6c3375f96027", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e795d722-f584-5e7d-9b87-a8537c2f9d6a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/bazel. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2f92556c-ee7a-5e57-a5b9-452be21806ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:b0647dbe-8397-576e-9de0-4e07154ac903", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2a4e23b6-23bc-5a1a-8a95-1e954c036a3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f92a8d8c-0a3b-5a81-85f8-728adf7fd67c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@16.2.11-tuxcare.4" } ] }