{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ed716927-91c9-56f6-9ffa-f7ad77a68969", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5", "version": "12.2.17-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:ceeecc19-34f9-5297-98c0-a6efd5fe8d75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.8." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:d305654b-7f8f-5c0d-99d7-a93972ef3ed4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:7c0068f5-0d89-5f59-865a-0c0165321265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:89942d4c-5014-5103-8957-ee93c6d2e93a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:9dd1ac25-f9b3-5cc8-8830-c9a5ca10cd6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.6." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:06fbef56-8d9e-508e-9733-fe657f307e2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:5c9d5ffb-0d41-5491-88d3-3e2082ca6c44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:38635752-bfff-5b72-a0a5-0db788d491eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:a41693ef-6098-5e66-84e0-ded716d5cc40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:1faac04b-dc28-5368-a4a1-67128c162d0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:0b2af01b-ea9b-59ba-bba3-dc1686a0e91d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:7194e3dd-44c9-5514-9a42-483510a32327", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:286e6190-ac03-5551-a131-33afc0488e63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:bf14d48d-f05a-59da-b0c6-7e4fc5c6f42a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:a62a1194-3995-57a6-8232-3dda7c36593b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:c9b93697-d045-5539-8001-98367e6b99cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:f2d13118-e832-52c5-abc8-f7a53f8bec95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:64ff2e19-9479-5f5f-bedf-7be6dcc6b021", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:2a07ed0a-6b8f-5073-80c1-9f1207dd90f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.7." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:5df5002c-749d-5f5b-8840-f0b20e7edfe2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.5 of @angular/language-service. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:835b24a9-c48e-5c56-8c5b-d7eb794b9aa2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:3a55f2d0-4e25-542a-94fe-398e59b395d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 12.2.17-tuxcare.5 of @angular/language-service, and is fixed in 12.2.17-tuxcare.9." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:a7b7423a-bb63-5a69-a508-af91e4df8276", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 12.2.17-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:fe2e4ed2-9887-5ef4-bb92-f44f10f93724", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 12.2.17-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:a9d9ffd8-245e-58ed-b826-c9d189e2c125", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.5 of @angular/language-service. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ], "bom-ref": "urn:uuid:2e6adc87-1883-5ba6-b8cd-a01f3016662e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 12.2.17-tuxcare.5 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@12.2.17-tuxcare.5" } ] }