{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6d355973-fedb-5722-a856-0acb64dd3d55", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler-cli", "purl": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5", "version": "7.2.0-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:09e414cb-ea80-590e-ba22-a570669ac9bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:51a996c6-df3f-50fa-8ff5-4358cc4f8521", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:742667fe-297a-58fb-921b-f7a6d46e4fe9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:bb986b31-58d2-542d-b044-397d18fd5c75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:03828b18-157d-50c1-aab1-22929f1be633", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:771d0d59-458f-54f8-9ad0-1e67c706b162", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ec487c37-29b0-5115-97f4-655395ac3c9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0f67d417-e2fe-58d2-8bcf-50728e2f878d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:869f5e51-81d9-5e93-ac22-7fa4116b37f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:f8fa1563-2c74-56fc-bbf3-85b4124019e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fbc4d34c-4f16-58d4-bf1b-ba78e4963562", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:b4bcd17d-1842-5266-93ce-3ae67ea2a375", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:4b8ad5fb-cfe6-5d08-901f-1e06a2b6958a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fe793158-3bc7-52d6-84bf-dbc5aff7aa9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:3b8d9a8b-b3a5-5a52-b066-0e3273a09f1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:e4f4dcb1-7d73-5fe4-9aba-de42baf5c525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6810bd47-d678-5455-8f9a-0b7fb423a110", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:9190466a-910d-5fa5-bbe2-ff1f13d9e43b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:62440ba2-e527-53d7-90e6-afd4294ef72c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ea9e6fdc-2ff0-571e-97f9-22fe4ad2639a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c6a7b952-850b-5870-9d70-7c30ed3aa711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:517b93df-3845-5c14-af41-fccc2e50e437", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:54496c2e-a096-51f0-bdfb-857375991d4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fa98fa4a-e5f2-5a52-b6ab-71ae7f13868c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.0-tuxcare.5 of @angular/compiler-cli. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable component (HttpTransferCache) does not exist in this version. According to patch documentation in the repository (CVE-2026-50170.patch, CVE-2026-54266.patch), the HTTP transfer-cache and client hydration features were introduced in Angular v16. Angular v7.2.0 predates this feature by many major versions. Exhaustive searches confir...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c4b63cc6-e787-582b-8fbe-9374043ee023", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:9736e08f-d6e1-5d5e-9b1a-cf3a53debe86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fa7e840d-5600-528a-ac63-b3d12305a086", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.0-tuxcare.5 of @angular/compiler-cli. not_affected \u2014 Angular version 7.2.0 is not affected by CVE-2026-88056. The vulnerability requires the presence of a `parseUrl` function in `packages/platform-server/src/url.ts` that uses `String.prototype.trim()` to normalize URLs, which strips Unicode whitespace and can convert validated same-origin relative URLs into cross-origin protocol-relative URLs. Version 7.2.0 does not contain the `url.ts` file; it ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:f5f3b3b3-adbd-5f84-a32d-a39b89722e52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:893cc153-6e13-58e5-b9cb-45bcace720b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:16795950-815b-5b62-ae67-2283c90a566c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.0-tuxcare.5 of @angular/compiler-cli. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, hierarchical HttpClient delegation (withRequestsMadeViaParent()), and automatic HTTP response caching features that were introduced in Angular v16+. Version 7.2.0 uses NgModule-based configuration (HttpClientModule) with manual TransferState only\u2014no automatic HTTP-to-TransferState caching exists. The...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:e22f748c-4e82-51e7-b1b9-4263cae413f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.0-tuxcare.5 of @angular/compiler-cli." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler-cli@7.2.0-tuxcare.5" } ] }