{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f8249330-9978-59ab-8457-f09421151561", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler-cli", "purl": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:82a4798f-e7cf-5d80-8bf9-d61487fd52de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:94c26696-99bf-54c4-be78-312516bfb456", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:89f31ef0-7e05-542d-8be5-f9c8c8e8ad40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5cef7714-8784-5cc8-889c-cc33e798bce2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:df14af4c-ec2c-5b35-816a-48c65b74abe4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:03af16c1-81dd-54bf-a1da-7b6a78440764", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a47038fb-de92-5d67-a550-618b166eacf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:4506a30c-c28c-5b62-b5a0-4f243dcdeabd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:0432820b-5c04-5991-a8ee-0fe30f7ac3b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:52395e94-4619-5606-835b-1ccda118ad7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:bce529c9-d0a4-5a40-933b-c46439fd47cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:bb2ee13a-6e9c-5e34-9c75-0c3d1c08a43d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:58de9bd0-eb81-5019-93df-49c5ddcd224b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:70b6f768-4cce-53fe-b4de-9780c7702337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:1f878cd6-c22e-5c01-8edc-a87fbbad21cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:99ed8397-d2d1-54e1-8fbf-305fee6a54fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:8f637413-7cbc-546a-8189-a42a1f3bb524", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:41496b05-1c8f-591b-b445-39f5c41a17f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:6c8f545f-8bc5-56b9-b334-ae8f1ddb7247", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:8544c00a-8711-5237-9632-6cfd637bf00b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:1b08c271-f21c-5a7a-949d-168fdac012d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:090785cc-df82-5f8d-8f9e-cd2550e76f36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:131a3431-2424-587b-9665-523d6b0432b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:31fd475f-850b-503f-8c0c-55c200c1730f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:fedc5658-42e3-5b80-a96d-77d18564d766", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:00f37914-db81-5849-84bc-d919b76eb4bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/compiler-cli. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:45a18aba-28b3-5681-b7fc-3d756fc2383e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:65f716ab-d234-5eba-8494-d910884cc34b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:198d9aa8-d81f-5c99-a4eb-5ceeeb6eb814", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c265b8b3-8ca9-50b9-a53a-ac7e26f73459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler-cli." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler-cli@16.2.11-tuxcare.4" } ] }