{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6ff5556f-31bb-5e5a-9bd5-cf0c081f1173", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:3663f00c-1a99-55d8-ad08-a97ef7b3c9aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c0a0392f-e03c-58b1-8c56-a48bcc999520", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a360cc72-d199-5158-a3f0-59b7bc896f56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:30ad7cd0-639a-51b6-b103-185dc290ec36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:bc485b7d-e81e-5aba-8759-70398b254aa8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:7f1608dc-21f5-5cf6-8c7a-3ef047dd1048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:b4d09d10-d05d-56ee-bf08-3ea7d5c36002", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2dc0b894-54ee-5478-a6a6-318f4b9eedd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:60160dc6-b0d1-5a11-931f-04f91df437db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5f461970-1d31-5891-b5da-d1478d72f1c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c76fac93-5723-55a0-901a-1c04edf1cf19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:54c0695c-dc45-53a2-bc16-a802bc32edfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c76ccb5e-aaab-56f8-9ba9-8f0ea030a33f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:8c036fde-667a-5464-af42-531282daef1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:455a7975-c12f-5cae-b6ea-8a1b7d348693", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:04e813ad-d022-50e6-95d6-5f7ad820efb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:b096c729-d532-595e-abec-d8d0cc03c0a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:11c2d641-e4af-56e2-8210-6648c6e44fc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ce256bdd-0e5a-56ee-b2e8-82268b45ec2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f5b720a0-5b47-578f-837d-2f6b70849720", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:aea28576-0547-5d10-8a32-dc96419f998f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:19f4901d-b82c-5bde-bbf8-5b94f71ea60d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:cc3c9c3c-8cbd-5c7c-bd31-f6721ec735ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:feb0cd98-ddbd-5995-8edc-a78c98cb6c56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:73190d12-e285-570b-83c5-d57889139fa0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a801bb17-3f07-5a67-bbae-58286d2166aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/common. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:00dc99d9-5501-5cbf-ba60-0072c8b5be21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:b55d05d1-1c79-5a09-a686-5c98398a1544", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:bf04039f-3c0b-51f2-8807-13659135f6ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:0c2c13b3-930d-5c07-8d81-ee2f1473abf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.4" } ] }