{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7d545556-4ae1-5bf8-a5de-e2de31d01b68", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@16.2.11-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3", "version": "16.2.11-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:f3ccef38-f7af-5472-8944-a70a93933152", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:de77ef8f-98e2-544f-9b3e-04ab57739319", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:40a76ed9-37fd-59f2-9a7a-cb9963f8d09e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:d16ea473-d918-55af-a001-843791ba1300", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:2c6e7826-d105-55d7-855d-c254e3ae968d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:9311ff95-0470-5c2d-862d-ba57aa28611e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:d5fcd2f4-9ffc-5f95-ab3e-28c18b613abd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:bb50e7fa-67ca-5091-94a1-76441511af1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:4593c17f-f36a-56d2-ab2c-85cc80747ce6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:8294c7bf-4fec-5b2f-bd0d-f5fee6712cab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:9d2e7ae5-8fe0-5a9c-a6d3-f89e9d73e34a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:35da3a27-b861-5452-90d1-6dd4587d6d53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:54a595cb-599e-5583-ab8d-2b50924fca3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:1e0d27e0-8a36-5b72-8657-edfdf75f6a2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:76d91062-4602-5c3e-bfca-b01582a39115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:0c9a09a7-931f-5482-91b6-b230d1a7d021", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:90a87318-66f7-51d6-a83f-4cac44813f5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:e2ae80e4-0715-50bd-a818-a4c82a05983d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:433a53c9-fd73-545c-80da-cb3fd3839bbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:01e59439-b3f2-5c49-8c9e-81d476ffb6d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:e16aa851-c50c-5bc9-b112-dddd787410aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:6dd4b5e1-3647-583b-b1dd-253af39ff15c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:7d981a26-ee0e-5984-a1b5-422ea0f5da65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:152a70fa-453f-5f2f-b461-e436d8c2c1c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:d01460fe-0325-5d32-88ab-3dbabf365574", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.3 of @angular/common. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:b3ce4b4e-20e0-5efe-9384-e7abd65baeb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:0ce35b14-ef87-55b0-a818-b86819f9c15c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.11-tuxcare.3 of @angular/common." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:10332fed-0f60-5548-a3cc-75b00c49b656", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.11-tuxcare.3 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.3" } ] }