{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ced00d5e-819d-59ad-ab56-39b3968ddbe3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/language-service",
      "purl": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1",
      "version": "16.2.12-tuxcare.1",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-59052",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b3fdabd5-e256-5c51-9285-caf66d5b7011",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-59052 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.2."
      }
    },
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8d22ebb0-3242-5473-9401-b0d7dc940803",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-66035 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.2."
      }
    },
    {
      "id": "CVE-2025-66412",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:683da616-9501-550d-a535-37200e962d8f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-66412 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.5."
      }
    },
    {
      "id": "CVE-2026-22610",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:59fc16f3-3ca0-56a6-843f-a1c6264824c6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22610 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.6."
      }
    },
    {
      "id": "CVE-2026-27970",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:941999c0-f486-5e13-a3f1-ac7853b0f937",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-27970 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.8."
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:412e1839-2b13-5beb-ae39-aa20e5508300",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.10."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:70b17697-bb3d-5536-ad5e-396d66865dc4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c312d080-2064-564f-8928-d9a0fd7f3a3f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:384cef9f-e6db-5a92-966b-dfd2b365aa2f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:36675744-8a92-5fae-9fd7-55da004db5c1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1307a59c-b3dc-5ff0-a358-9816dc5336d2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:015041c3-eac4-5906-8dca-6829461cd6fc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f77062c1-7593-5e46-b1c3-2d3515043448",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-50557",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f347ebcc-331e-53e0-96ff-bd4ab64fb5a2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-52725",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b93a15b7-153b-51f3-b2f8-b56ec08d5ecc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:00c0e508-7b63-504b-9561-54316ac7f64f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54265",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:27d6b738-9ed4-5682-a7fd-73740289cc2d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d264a973-764b-5462-9ce2-7a4526fc18b1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54267",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:975754bb-c46a-59db-8ded-9d5248f1a34f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5247bef5-d692-5eb4-b441-ef05c1416765",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f6eb594e-a4c9-53fd-bce0-538c56dd6b1f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.12."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a9a62837-8a96-5d89-8eeb-a2b052ba8b65",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.12."
      }
    },
    {
      "id": "CVE-2026-69151",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e88fa35a-c69e-57cb-b01a-701cddcb5e89",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.1 of @angular/language-service, and is fixed in 16.2.12-tuxcare.12."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:720b122b-3e46-5fe4-b10a-1e2971bdddb7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.1 of @angular/language-service. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88057",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:32ab483e-e487-5fea-b626-8bf946a1e3c4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.1 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:14f33498-dd89-58c9-aa5b-d200f8dd4953",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.1 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aa715070-4575-5333-9253-596fde807a62",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.1 of @angular/language-service."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.1"
    }
  ]
}