{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4c9326d4-7c63-5e57-9228-9d719527754e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@17.1.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5", "version": "17.1.0-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:8a0b5324-9b2e-5555-b139-f3e1e3ea9a38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:af123045-1efa-5553-b815-e0c2e643d786", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2aaaae0a-5c33-51ee-ba6f-edc078c3d81a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:3bf5d3af-f00a-5e8c-8cbd-8c36812aa0f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:1b629c5f-cb71-54e5-bc5e-3aa27d28ca41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:5582c990-4dbe-57f8-94a0-e6879067d805", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:a9e51bae-2769-59b2-8e95-791ef6c10a27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2672e92b-9fe2-5721-8132-37f90350c53e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d87583ec-8441-51ce-9f62-8a06b2d72181", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fe7a084a-5c8c-58a5-a2b8-903f37377957", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c2145b70-c3a4-5eb7-9585-1bd005379eac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c2b01ece-3efb-5b0a-8af2-2b580b1bb5f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:a76776fd-63f4-543b-a4d6-9fa98fb20673", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:35ce43cf-67da-55fd-b90d-34a17bcb6912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:a943dd21-94f8-5f39-8ee2-fdd4ff852f32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d7bdc83a-03da-5fb6-8ba2-42113a2fad24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:7a86adb8-701d-55a0-aa19-613f03247781", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0312668c-5a96-5ba6-9962-1d0899b6bc96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c0e6fd32-0bf4-521b-88ea-72d602d7d924", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.5 of @angular/core. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:80f13058-2d92-50ee-8379-3e77448a97a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c83968b1-4bf6-5e01-affb-6adf66ff8243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:3edf9bd3-b93d-5d9e-88ef-ddcf5189f203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:62e29ab6-4568-508d-b8cd-5dc576807771", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:dee1ed15-70ee-5ff7-b321-ab567484b460", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:7145ef90-1afb-58cb-80f2-f417f5629c81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:afbd8d0f-ab04-52be-920b-c5534ba71dfe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.5 of @angular/core. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:63c276ff-d1e8-5743-a0b7-4b5a109159c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:67221f0f-1fa9-504a-ad7d-17fdf8906d3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:a5cc2fb6-8a41-5764-8112-6b8f5ae60d58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.5 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.5" } ] }