{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:23136912-8fb3-56ae-9efa-8b3b2aa0c015", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:720602fe-a3a1-5e2a-a4d6-4b5beb45f6e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:fbe3fbc5-2e8c-50bb-aa03-9b02cb08cf21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:64ca4b66-8e21-51b6-9550-34e650938907", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:76c5ecc6-c7d3-53fe-a4bd-b399b3439ef6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:34e7a76b-6ac3-5054-a7a9-075e7172c839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:4e40c341-98fe-5753-960d-14aa83d9ca67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:53c396dc-32ab-518b-9019-41a55a94a463", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:683ef3e5-5dd1-5f81-8c1c-70310d5fd873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a52649a7-aa67-5fb9-95b3-14bb9055a9f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:876c7d02-171b-5b58-9804-549538a28a34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:bba053b7-8b4e-51d5-ba28-f15256f6935e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ffeb5b2f-5357-5804-83f7-a648b1fb4785", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:32082c26-0c41-5d48-b906-4ae16a782e86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:341b2a27-8746-529c-b764-4920880ca38d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:36afd37f-6b9b-5b5f-abb2-6934443b3a7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d1a4d6eb-d028-587f-af19-0acde8180621", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:b387760a-30c7-56b5-9e13-a7f253c61037", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:6a7f4758-61ac-548c-a118-22ead022afd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:0614a57e-eb37-5d2a-b63f-4af2462303e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e7dad11a-f5ab-5904-a1ea-2b4d8d6d6979", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f97cec6c-82d2-5c78-bbaa-1a1ffb75ace6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:571caf27-1cd7-51ec-b350-92c3ff697597", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:86ab0a14-357b-5309-bb2c-20e30bda597e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d00072ff-47bc-5416-b954-f65f93f578a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:edb13406-1a05-55ec-8e61-0ef0061b02f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2af751fd-17d7-5c0f-813c-e6175023adad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5d1678e7-7f9c-5509-b50d-41dff6198990", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:8ff8f9ec-475a-5ccf-b09e-3e33a687f8ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:b98c18f1-d26a-5345-a376-55545e1dbb96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:47a47f53-d33a-5f6c-84ff-c31e433cbea9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.4" } ] }