{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ada1e381-3101-5cc3-9159-936691c87a19", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@17.3.12-tuxcare.15", "type": "library", "bom-ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15", "version": "17.3.12-tuxcare.15", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:89b8dfd2-a136-5fb4-90f1-2595d986fd46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:573d4a2d-490b-5591-a6d7-5bd4b4566a86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:d267906b-0a8a-5253-9d15-cfb41b06cd8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:ce762da6-4135-5f88-968a-bf9092cc3711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:e59ef7c4-ad24-5c3e-bac2-5dc93362f370", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:38a19583-1ba4-5180-9bfa-69bfe3edfdc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:9e4a0dac-2b84-5ae8-a43b-780e9b235f24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:20d0404a-ddc6-5ac3-bb2f-bc94721713bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:c38c481c-6b45-55e7-b3ad-00fc9ee4b9ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:e0dcba03-7eb9-539a-94c7-9cee0f8395f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:6df4835c-21ea-5e1e-97ea-9c2558317cd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:977708c3-37ef-5ad0-a774-3e7884b077c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:a5057105-34b8-5550-a741-7e9998fd6a79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:af0994e4-065b-5e4c-b9ee-3e3a47bb6464", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:5730e870-c686-5af9-a711-48a19fceaa34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:5e17fd60-e048-5122-8b7a-03549d94bb37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:77554b40-4561-51b5-b0ee-0453575f874f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:d4e5b1f7-00db-5f92-b88c-f342b4e7ec58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:391542d4-8844-576f-9f2f-30b58ad96843", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:49df5ffb-e4a8-51a4-8bbf-7869d0cb9be5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:5c1034f4-3d71-5168-bbfc-0aa66bc746ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:b3bcc687-b9c0-5632-a478-c28f635d94a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:7cb89f16-bdcf-537c-9330-de7a6690a41f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:596cc81d-8242-5b7c-aed0-9d54a649964c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:35296162-7642-5e3d-8ef0-7beae8895995", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.15 of @angular/core. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:78b96f64-6e71-5d8d-ab42-5e89c8aff0b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:544b0bff-e0ef-5482-8a8f-75321360c8eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.15 of @angular/core." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:84a7327a-814a-55e2-ba32-4870b876bfc1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.15 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@17.3.12-tuxcare.15" } ] }