{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1645f9de-e535-5cd1-a904-9a6a6372127c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13", "version": "7.2.16-tuxcare.13", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:ecdaed91-5c75-5e16-9204-5985b5e71ab5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:a913c461-3a4d-5c09-85d1-4d306daf95e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:5847774b-3818-5baf-99b5-149288d24228", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:5c5cbabd-7248-545a-ad74-7b1f71ba9332", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:7d16274d-7194-5bf2-a46e-8558bf4017f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:6a092fa4-7146-561e-af58-0910a641c2cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:3ec81c19-8cc7-554f-a2ba-a772dd3cf18d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:0a434561-4698-567b-99ba-423b4440906f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:42bbf897-9837-57aa-ad70-1e24f5e93ba9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:24960822-1969-5fd7-8c30-ef616378d61d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:452829c8-b900-5afb-b7bf-564345a7a38e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:d2be1d5b-6334-536e-96ec-9dc6546ccca7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:4a2cdbe3-7beb-5a84-8f84-d2c60af9677c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:ea8abccf-ecda-5f01-b6d0-ae97d2fde946", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:29fd0dbe-8eb3-5b5e-85ee-fa95707cbb45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:c2b0de89-4402-5d6b-9d91-33d71459a52b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:aba5faad-d3bd-5c36-8820-dec5913f0dbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:1797b609-d5f8-5b1f-b48e-eebd65eed53f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:dbac6bab-7ce6-5b84-a60c-47e7133d361b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:f4cc492a-fde9-54f3-8e1b-2c2877dcce71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:bffbb36f-da02-5e80-8d56-500612446f1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:6e050e21-fb32-5a39-8848-96a67922f004", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:4a22eccd-3ff2-5064-bee7-592986ba8641", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.16-tuxcare.13 of @angular/compiler. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-68945. The vulnerability concerns HttpTransferCache's cache key generation logic that treats repeated HTTP parameters (`?role=user&role=admin`) and comma-separated values (`?role=user,admin`) as identical, causing cache key collisions. However, the HttpTransferCache feature does not exist in version 7.2.16\u2014it was introduced in Angular v16. While v7.2.1...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:3b7aff93-d584-59a6-8b4c-9b7cb64d3e44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:82614484-83fd-5fc7-a99f-1812d2cc9c27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:b889d8a4-899f-5417-9daf-bd59e703c5c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.16-tuxcare.13 of @angular/compiler. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88056. The vulnerability requires a String.prototype.trim() call on URLs during server-side rendering that strips Unicode whitespace characters, converting same-origin relative URLs into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 7.2.16. The CVE describes a vulnerability introduced in later Angular versi...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:23f25a5e-1180-5168-b3ed-fd7e26132e08", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88057 does not affect version 7.2.16-tuxcare.13 of @angular/compiler. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88057. The vulnerability exists in the Ivy compiler's template pipeline (introduced in Angular 9+), which does not exist in this version. Angular 7.2.16 uses View Engine, where the SecurityContext determination for directive host bindings correctly uses the concrete host element name (`element.name`) rather than the directive's selector. The exploitati...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:92f95cd4-2ab9-5bfb-b1e7-96c1d4722f80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:b7b8ca25-a935-5de1-b46e-6e5b4473adb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.16-tuxcare.13 of @angular/compiler. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and client hydration features that were introduced in Angular v16+. Angular 7.2.16 predates these features by approximately 7 major versions. The codebase contains only legacy TransferState (manual key-value store) and NgModule-based HttpClient (no hierarchical delegation...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:64854c5f-c80e-5dff-87dd-d97057326c22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.16-tuxcare.13 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@7.2.16-tuxcare.13" } ] }