{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:18801c12-fb77-52c4-8f94-545199accd02", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/elements", "purl": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:427142bc-646c-5d4e-a867-4168078bc757", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d972e5ab-028b-5028-b6d8-5d6a71836956", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d89c4bb0-251e-5cf7-aaec-9c9cfbb3b4fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:cc67e43b-f7ad-598c-bb2e-fafed6baa44d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:0012e4b5-73bc-5eac-905d-0bfebc568029", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:fa645cc8-9ba2-57c1-9c59-7adc1bf23450", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:8c9042e5-4a36-55f6-abf9-eb30edeba6b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c6005ba0-d43d-5640-b789-b0ddf2742b8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2239197b-f3a0-577a-93c1-33c23af184ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f55c51b5-12d3-5174-938c-146aeba19d69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d2385783-0576-5a15-b7e9-7af28ebda79b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:38e5bcc1-6815-5d9d-b213-cd56e92f63cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:df97110f-704b-5d9c-a134-fb1bf774388e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c86838e6-1277-5b6c-bd28-36545834149c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:08c9d7a1-854c-5c9a-ab3e-381e9aa30889", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:33734f2f-019f-566d-8f79-537c0d6e6328", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:059e96d5-53ff-5d3f-a56b-4d9bd0d36c8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:80fbe9d7-9313-56f0-bd2b-22ccb0ac6f52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:8dad848c-81f5-5371-9fd3-01365c65f99e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:b5ed7d49-6f75-5b94-8308-bc84c8bb51c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:884b11b7-fdb1-587e-8d93-c908f4c1d467", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:152fe088-074c-5989-aad6-8f733a07e0eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5e11cbd0-f820-5fda-b158-4972be3ad57a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:9fdd6ac3-0bb4-5bf0-b6e8-f2b383433422", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:7f80437c-8425-5e9e-8e5a-be7b8ea979a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2d8af01d-14b6-5024-abee-1b45f6d0c6a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/elements. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:68e75947-eb47-5ef9-8201-63085366acd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e5d87f07-8d65-5f55-8af6-08d1b5c0f2cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:719e4cb6-cde2-5d12-8f6d-8a2b356557c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:24a923f6-3e34-5292-afbf-6ac63edaff52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/elements." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.4" } ] }