{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fe6e70eb-fbaa-5eda-b8d4-2f118050a328", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15", "version": "16.2.12-tuxcare.15", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:ec5ea671-29eb-5dd3-8d35-c0ffba57f0bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:6df8cc16-1973-51ab-bd55-a9554582530e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:7084e9b7-55f7-5032-800c-5d1b7171c8da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:2af97ea8-a99e-568e-b8c3-2db06a57d579", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.12-tuxcare.15 of @angular/bazel, and is fixed in 16.2.12-tuxcare.16." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:a2c2e5f5-679c-599b-b9d5-a912e34209f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:6b89d35b-5572-5db4-81a9-e32c5aee38e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:4e68de1f-121f-550b-9fe0-ac9bac11fe13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:cef5e069-a34e-59c5-8684-a99ec594f951", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:4cf91bf6-0dea-56a9-a43c-d549286cb6ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:cfcc7514-60a9-57ce-9a37-dae9d60e2c9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:2261b453-1d07-5f70-b2fb-6a8c7e6f1d9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:afe6266d-8cbe-5e5f-98dd-235f9166a208", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:3ff6942e-46c2-503f-aae2-ff2954227e76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:0ffcb944-2ced-53e1-84dd-e16bb9109d7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:83f7a4a5-d784-5372-b629-45dd8305b5db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:2b484d07-5794-5960-82aa-81cd8cd9f139", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:75cb0779-d75d-5351-9c29-aa15bcc9a56a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:d18df078-83f9-577a-90f4-5f3aa81a5f0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:9ac4e110-3d6d-5cff-a006-e2736fd7ccd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:fe477afe-dff9-5020-9393-1844784f458a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:62d5ae04-b838-5bef-af99-d92c944fe263", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:5220a464-189e-5c85-8f12-9a29e1db3aa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:de0001cd-c96e-5e28-97a2-7a85bef98552", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:e4e9b0fb-7ed5-570c-a6d7-e24c848b73be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:4d35e6f2-c2e2-573a-a9ed-bc617e0350ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:bc722d58-122d-5ef5-9ff6-5625dba24559", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.15 of @angular/bazel. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:fd4fe2c7-5089-5bb9-8ad0-94a363211fe2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:f82c1bb9-5666-5650-9b37-28c49d027a01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:afb4ed3a-17b8-56c1-af10-70059a2b1c8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:186318d8-2585-5713-afba-e7c913a80e76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.12-tuxcare.15 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@16.2.12-tuxcare.15" } ] }