{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:afdee1d0-c4f1-5f4f-9daf-67f4c50f898a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/animations", "purl": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8", "version": "12.2.17-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:c2e3ce88-3d91-5e4f-8182-b26d3d649aca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:ef1d16a4-5d4c-5cc1-a193-fe3971c870ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:b6e8e155-52cb-54d0-a909-c6f7cfe3724d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:3440e183-731f-519f-93b0-fc01792eeabf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:9ce15d5f-b675-5e57-a89d-2b4fe476d2dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:1af7de59-9142-5c25-9028-2371c6947d40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:28fd7c7a-15df-5939-bea8-098e2d099ed9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:6ca6a345-5dea-5791-b6fa-7b7d72ce99c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:8d563116-0403-5949-8dc1-25b6b4854dfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:11f674d1-0f1e-56ca-ab35-fcb9045a3b88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:d6a047da-64b0-589d-83cb-0e3ff46f34ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:2361e115-71b8-58d4-a327-2f7e8e30528c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:ad6749bc-03b3-5edb-95f7-3cb17fef13a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:18ee4b99-040d-566b-a9b2-152a0587def2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:63fc1b77-85a4-5c1f-9b15-36192f714606", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:9b8f0691-ce46-5e7a-8b33-bbd4cc9e54c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:97b86fcb-c849-58fc-983c-9ab0ba6b52cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:d10625c2-9d87-51c8-a7ca-9227256c7ba5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:113d5f97-162a-59c0-b4b9-6c34aa02d9e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:4674c60d-d1eb-56cc-99a1-eaa5230bb2b8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.8 of @angular/animations. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:61e1b305-b8bf-5b50-a172-adb214141ef7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17-tuxcare.8 of @angular/animations, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:1dc56f7a-f25f-5c05-8fcf-5b33c7450bef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17-tuxcare.8 of @angular/animations, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:30af0717-67a0-5337-b249-9d71c6bf1f85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:6843534f-021e-5732-acb9-888ff0480f3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.8 of @angular/animations." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:be050b38-1eb5-5d86-91f2-8de21f2a3f09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.8 of @angular/animations. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ], "bom-ref": "urn:uuid:dd616169-d485-5d9a-8b64-0474e7282122", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.8 of @angular/animations." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/animations@12.2.17-tuxcare.8" } ] }