{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a949f263-e934-5989-a1fc-316e0b6a6555", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:1b6222cf-cbc6-5dc7-87fc-effbf9ad11c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f0e1a814-e00e-5038-924e-2ede6b4053f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:79537c36-3a4f-58a3-9b95-b418518e350b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:3fd290ac-438a-5674-ac5f-072dbc5e079a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:152d8e38-101c-57bc-a288-4f2ece898c65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ca42c659-0592-54eb-a849-6dd39414528f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:80dba60c-ad5c-58ce-8fdd-6fa1e6587b48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:0af7e713-d326-5b25-b1ea-316edd4489c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f4f515ae-60d3-5f72-a985-439c80f46c7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f4101a60-9216-552c-aacf-6ec4afa3ccec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:31db32a4-ec2d-5340-9b42-e4854f8dd7ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e47de7a9-97aa-58ad-a4aa-82ae6af99b2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:274bf1df-ec73-50cc-a941-5568b337441d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c5880ef5-12ef-5c80-b566-606bf0aaec7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ed5d64f0-ad98-56d4-ae1b-2b226608ea8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:aee58d51-559b-5446-a214-d3bd44331082", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:9202a7f4-6ca7-5489-ad1d-8be48d351cf3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:b1632660-6a97-5d33-8cb1-d17dbee4f3b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:6c7ed18f-5385-51e5-8303-e60f503344fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2db1c93b-2745-5163-be9c-ac683ae410b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d51e1634-90ff-54fc-b2eb-5253dbada488", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:6c0f5056-2680-541e-b363-fbcf1eed4e79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:3b79b294-9057-50e0-856f-25a819925c7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5cf221e1-e3a1-54cf-8706-9f16403c45d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:8634a69d-01de-573d-b32f-302b780d0080", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d654a751-6828-54d2-af2d-4485d60ffd4c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/compiler. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:407a09e0-833b-54fa-8c1c-17672c697add", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:920ec290-1e8d-5256-b478-16efae8e470b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e7f8cbe9-5784-5b20-99e1-0e4c5f4d8dd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:6dd06cbc-79b7-5a76-b4b7-c60e01c4a789", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@16.2.11-tuxcare.4" } ] }