{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:030c3ce9-b7cc-5c88-bb94-fa3bf9b0df54", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@16.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5", "version": "16.2.11-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b0e2a06f-0bed-5ccb-8afb-92af8183bcad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d618b131-83c3-5653-aec0-8bad328e3e09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a4bde8d0-138b-582a-9a39-d6d26608ae45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:3c81375b-e7fe-5601-94f9-d68d84dfaebb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.5 of @angular/common, and is fixed in 16.2.11-tuxcare.6." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9a0a878e-5992-5cbf-9a1c-25b8564a5d90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:dc713502-f362-5693-95b8-9313b73b0ee0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:cae645fe-c9d9-5a24-93f7-6e2ab57b8bf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:422a97d2-2927-5dd0-91a7-1e23ee83ab65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9ce3b208-4d7d-5c5c-80d4-33c9b5d70e88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:050b46a0-5273-5374-9a6f-12a5f396e8fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:27c9268b-a2ca-5f19-91cb-80caf7c60a83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ffd6703d-0fad-504c-9e4c-8dadcc16d2f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:6b856ae2-f4b8-52d6-a175-2e34edad3ae3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b044ff45-8f4d-57c2-9f01-9a71c4b47dfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:3401f01e-907c-5604-9394-2fea02457ae4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7fc80037-9cf7-56b6-aaf6-370ec27d6a0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4651ece5-e1fd-598a-a890-39c6be9a239b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:26f0125c-0f21-5698-85d8-4f9d0de8df55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9050c5b5-f545-5fb9-bf90-b7c4c5c494c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:756f8fb2-9e4b-536c-a7f9-a6bedd497204", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:cbbf64aa-94db-55a3-a65e-bf6b2b654c78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:80565f03-fe8d-505a-844a-a29e88b9921d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:e376ddf7-b35b-573c-80ff-805bd72a5c37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8ecb826c-1327-5367-90c2-c4d60ad7d643", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8ae66af7-6b9f-550f-a889-9e01dd27760c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:092439fb-8b05-592a-871c-310185f733b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:403bc6a4-3594-54a9-9320-c07ec7d38f91", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.5 of @angular/common. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5b4185bc-d831-55a1-9c1d-2d4e2e80378d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:391fb205-e9f7-5da1-b677-06ff0b979847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9329750e-1325-5e66-85bc-c203c4ce67f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f4070277-3c3c-535e-9759-5ededb4eb509", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.5 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@16.2.11-tuxcare.5" } ] }