{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8bbe9b9b-8b97-5036-ba5e-21a3e2ed4472", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:7e28c836-6007-5358-a267-70002fbd09d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5456baef-7781-57df-8d9e-64cc6c83e226", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5aaea6c4-34b3-5964-8ad0-9fd1546c1440", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d017e919-63ac-575c-ad2a-708cb51b8c3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:868021b0-ad9d-5e97-b946-b14db24bf834", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e6ab2c13-56ae-524b-9a20-50c2b8461737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:49c69e9f-3fa4-5075-98aa-73158bd1cc2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:65e3439f-8ad5-5b69-9a27-f281f0bcd3fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:7113c248-fbe9-527c-b1ef-881fe311e1c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:46f31199-0553-5211-b0b9-3c4170d4968d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a6feb959-f881-5e78-abf9-b0cf540910dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:830fcde3-9393-5b12-8840-00cfc54685f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:84869394-03d1-5211-9455-74c7ca03ebd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:00968299-bff1-5e25-b4a5-5740e4e2d6ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f08fc32f-d1c7-516d-8fc7-db5c7c1d7b37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:086c497a-0de5-5562-8074-286b94ef74f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:eb9eef9c-4cdf-5e29-b44c-cfbdae486e9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c720ba00-93e1-5bec-8ffc-843b62b73e1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2e0c3d61-8327-5a87-a359-e724366978d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:fbfbf1bb-0401-5533-9690-d1ff48851c13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:262c90c7-06f2-5589-98a3-7669074184f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:dc9dec14-ba8d-5546-9d2f-4042815b292c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e6951d90-6bc3-5d95-bbc7-e4f4a124bb5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d7b39e55-59c5-5476-8a39-88ae5db3740d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:0bc45aff-fbeb-5389-b48a-34b84b08e448", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:0b033131-642d-5f1c-b9e5-e78832d6d916", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/core. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:119aa2c3-9d24-5700-961f-de7f74b4df14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:bb2948c9-082b-5890-8308-677a4c412d65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:32282215-a1c5-559c-97d7-a8b1a6c72d47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:dc1ca4a7-e808-5a09-86ee-37e7b86c1908", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@16.2.11-tuxcare.4" } ] }