{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:177edb10-b38a-50c4-9c76-593e49ad8935", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3", "version": "16.2.12-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:94083579-c207-5ab2-85b8-8998cacb1b20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:8816ffb0-b97f-5462-80cb-09cd01fc3742", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:a929bd1f-e936-5336-baaa-e507a4b2a332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:f9136410-a3f6-56aa-b319-ce5dab35902b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.6." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:39a1d2a1-42ca-50de-8f72-ab2141bb4f5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.8." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:3b63be99-3d47-5808-90bb-27e53a5ed402", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.10." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:5e959ecf-3119-5bd8-b66c-a73fd928c21b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:4ea4dde3-d144-5583-aaff-793e5618e5c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:d6ee51b6-7ad9-54bc-b2c9-33b3279cc374", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:b864a9c7-64d0-51ca-89f7-d765c07ef0b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:8b2cb44b-fb67-5762-a2a2-b8ef4088fa25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:9d8d6353-ff89-58cc-bf38-85ae0038fde9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:6ba9f63f-c50a-588b-91e1-56da1f84bd11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:908cce7f-e6ea-5424-a158-8f01671e374f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:4efcac56-753e-5da1-bedb-ef60ebf096b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:41b3dcad-e9b0-5d23-9c3a-f3b99396a150", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:f6473dd6-2fcb-58f9-a81c-d2a6633921eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:27c3c639-7f69-5ca1-9f4f-0df9f626ac75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:735508df-6a6e-5091-9f5c-4a64a7e34975", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:641e0fe4-e8c4-5eba-8e2f-4e4cbf5b0641", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.11." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:a646d232-f1ae-5457-9e86-cc9360eee79a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:2450e782-2b38-5ff2-8c78-6f7e84a82b8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:248f11d5-d33e-5eff-85f6-78796174a47b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.12-tuxcare.3 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.12." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:89a48080-fc56-54f3-ae09-6832e615fd8b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.3 of @angular/upgrade. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:ccf39171-a219-5257-8b1a-33faf9357153", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.12-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:652e2df6-6410-52aa-beb7-b3e5b617cf0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.12-tuxcare.3 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ], "bom-ref": "urn:uuid:20392298-1654-54ed-b336-b3d889b89727", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.12-tuxcare.3 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.3" } ] }