{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fb60ce05-db35-5980-97fc-d8f420baaccc", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1", "type": "library", "name": "@angular/core", "version": "12.0.0-tuxcare.1", "purl": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:2bd36167-0d00-5920-9208-795c382413b7", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:abe51dfd-c04c-5dce-bf67-a1a424e605a6", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:487a1a8f-0606-56b0-a1ae-d1b039a0dd4c", "id": "CVE-2026-22610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a0442db9-2e68-5af4-b6ef-a547e4e1864f", "id": "CVE-2026-27970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e58c5be7-380b-55df-9675-1181450525c6", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 12.0.0-tuxcare.1 of @angular/core. not_affected \u2014 The target repository (Angular v12.0.0-tuxcare.2) is not affected by CVE-2026-41423. This version uses Node.js url.parse() for URL parsing, which does not exhibit the hostname override vulnerability. The CVE affects Angular versions 21.0.4+ where the codebase was refactored to use the URL constructor with a base parameter, allowing protocol-relative URLs (//evil.com) to override the hostname. T..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f2fc0c25-7d1d-586a-8b94-ab3df2e89dd0", "id": "CVE-2026-46417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7bd0dbcd-8b9c-551b-8e73-93696f0b5055", "id": "CVE-2026-50168", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4cca4df9-84db-5a2c-afa3-ee83ba2ab01e", "id": "CVE-2026-50169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:715355b7-93b9-5d04-b675-dcb14d889015", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 12.0.0-tuxcare.1 of @angular/core. not_affected \u2014 Angular v12.0.0-tuxcare.2 is not affected by CVE-2026-50170. The HTTP transfer cache feature that contains the vulnerability does not exist in this version. The transfer cache was introduced in Angular v16+, while this is version 12." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:78024348-5493-586f-a116-efc529978e7e", "id": "CVE-2026-50171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e68c1ede-e84a-5bd7-af75-6275df1a4ab9", "id": "CVE-2026-50184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ed1c879a-5d3f-56a6-ba48-1fb2a54e56cd", "id": "CVE-2026-50555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d59d483c-35a5-5d35-84fe-a2e0e470fca5", "id": "CVE-2026-50556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6eb752ec-d08b-570e-b5d0-d3019777623c", "id": "CVE-2026-50557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3e0ed69a-58c1-5ee8-8eb0-69b982ce715a", "id": "CVE-2026-52725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cda7e039-1199-5e76-b1b1-019c1eb6e140", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 12.0.0-tuxcare.1 of @angular/core. not_affected \u2014 Angular version 12.0.0 is not affected by CVE-2026-54264. The service worker's AssetGroup class does not preserve request headers when making network requests, including on cross-origin redirects. Version 12.0.0 predates the architectural change that introduced metadata preservation (including headers), which was later found to be vulnerable in versions 20.x-22.x." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ffdc40d7-e327-5187-a494-18bba20496e6", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 12.0.0-tuxcare.1 of @angular/core. not_affected \u2014 Angular 12.0.0-tuxcare.2 is not affected by CVE-2026-54265. The vulnerability is specific to the Ivy template pipeline architecture with TwoWayProperty IR operations (introduced in Angular 20+). Angular 12 uses a different architecture where two-way bindings are desugared at parse time into separate property and event bindings, and the property binding is sanitized through the same code path as..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:78132039-7184-5d78-8183-4667c043a0c2", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 12.0.0-tuxcare.1 of @angular/core. not_affected \u2014 Angular v12.0.0-tuxcare.2 is not affected by CVE-2026-54266. The HttpTransferCache feature containing the weak DJB2 hash vulnerability does not exist in this version - it was introduced in Angular v16+." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3482f54d-dba6-5429-96d8-15aabc2ebdbd", "id": "CVE-2026-54267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6bb26f9a-7877-5392-8bc9-e7204481d54c", "id": "CVE-2026-54268", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 12.0.0-tuxcare.1 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@12.0.0-tuxcare.1" } ] }