{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:20feab09-ce14-5197-abde-cbdc52597cee", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@17.3.12-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16", "version": "17.3.12-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1f755eea-6578-5935-b63d-2cf5e52a6471", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ce911836-735e-5c3d-b7fd-8235f781b681", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7c883b91-8ff1-58bf-b38e-40cb218c8e77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:26ce3380-6147-504c-88ae-9d1bc887b4d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 17.3.12-tuxcare.16 of @angular/core. not_affected \u2014 The vulnerable code (domino's lib/HTMLParser.js with the after_doctype_name_state infinite loop bug) is NOT present in this Angular source repository. Domino exists only as a declared npm dependency in package.json (line 110: \"domino\": \"https://github.com/angular/domino.git#8f228f8862540c6ccd14f76b5a1d9bb5458618af\"). The BUILD.bazel shows domino is bundled at build time from @npm//:node_modules...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:23574e5f-db5b-5116-ade4-e6c31317f8b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:27be9504-dae3-500e-930b-806e6b213406", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:999a00a7-f02d-54b8-87f5-274108fa4011", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:0d2e18a8-f28c-59de-8a4a-4e8e2c6deb44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:86204873-6b72-5dfc-b996-beadd9ba87de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d57612de-fc4e-5c29-b06c-9952dff40e83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:97979d5d-8779-5317-8839-727161a96039", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:3adf560f-a6f3-5c3d-aa53-7e4020eb8a97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:bf904618-0291-5bad-ab7d-e179eb239fc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b15941e5-f910-56a9-96c7-48595891d5dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7b6b906e-79c8-5d45-9684-1cb6e06f259c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7e046ef5-ae85-5d80-8cab-323a5e6b378e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:cda956f3-fd24-5189-8371-f81bc311870e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:85c6404e-5657-5bf0-a674-cdf78c64c926", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:fc118c5a-01e8-5f7b-b0cc-af4070ac577a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:9921b007-aa60-52b0-b30b-f09c0aa5f6b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:8c387513-9a6b-5bd8-8f0e-26fa46093038", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6fe93d40-e154-558c-ab79-e5278ba7c42b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:35f92da0-c8ab-5fb9-a307-cb30c5841c14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:771956f5-31b7-593d-bf5c-371f99fe2106", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b19fe1cc-63a2-5dd9-95e3-83d1ae8cc06f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:04e5bed3-1a9c-5279-a100-fda3f613c4bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.16 of @angular/core. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:a4b4877f-87a0-54ea-891a-6826815ac90b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:3d0d6059-ed94-5687-9dec-f1640190d6d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f0380fdb-b478-5afd-b746-56cb9813a484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d02e7f6a-4d0d-5e82-899d-94d15c8d8581", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.16 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.16" } ] }