{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:aa72cdd7-5951-5e2d-9d70-1c23df61c71e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/router", "purl": "pkg:npm/%40angular/router@17.3.12-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8", "version": "17.3.12-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:d0cdd198-5c5e-503d-887d-7596c0512470", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.8 of @angular/router." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:b6f21fb4-40ea-57bf-8078-a9901e397702", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.8 of @angular/router." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:14961ee0-3a90-53ad-afc3-5197e13961c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.8 of @angular/router." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:96ea3c16-0acc-5f4e-b27c-4b97792af020", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.8 of @angular/router." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:76e2433b-0008-5311-a0b1-f758f185d7c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.9." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:bbea47a5-4d13-57bc-85f4-aad10317e3e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.8 of @angular/router." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:4f16c913-2462-5b75-93ac-b7462e5a150d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.12." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:a66e7e2a-0451-5b88-9054-63156f341086", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:9db5e25d-ac3a-59e2-8c4f-8f190a25ae23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:52eb8a05-5f27-53dd-bc00-5321d7bbb0c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:febb2125-65a2-5bca-8b15-33775acbeafa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:b140b24d-0dc9-5425-ab95-7c1e014c091d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:3520f77f-e24d-509a-8918-20e887d5d27b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:a15e8d63-8b3c-501b-9091-6e2c930a3492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:0299dde7-2883-595e-b0a3-0a7b4cc8eb58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:3655f5f5-f80d-5ac1-a55d-f59428eb9c3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:5ec8b841-e485-541b-a0ff-f46bac9c4214", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:157b2359-021c-51b4-ae39-5fdeebe2b47b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:563c8637-e4cc-5a17-8c43-aae1871740da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:daa6eacf-02c3-50fd-9064-f9c1548e5d8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:7b15d844-a325-59f6-8b2d-fd1cb9a9d6d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:ce96e2ec-2319-512d-8cea-b82a091f8a07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:f1bd4370-983b-594c-8eb3-48f0b7687bd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:8df7d382-eed1-5f18-af0d-0b0ab97549a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.3.12-tuxcare.8 of @angular/router, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:e5ec1148-b3a4-5be6-be3e-96608c734a7e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.8 of @angular/router. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:337a5d9d-b962-5209-a5a6-264b23c084e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.8 of @angular/router." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:ecde2dc7-4554-55d8-ba77-15cf3ebd6e29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.8 of @angular/router." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ], "bom-ref": "urn:uuid:290bf7b2-7d95-5b3f-8907-8644911f8655", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.8 of @angular/router." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/router@17.3.12-tuxcare.8" } ] }