{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f3a72472-e616-5c38-9a3f-1fb5f5ce36a8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@12.2.17-tuxcare.12", "type": "library", "bom-ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12", "version": "12.2.17-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:8e0c38d3-482d-5620-ab8e-7d036832b147", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:d8794c4b-cae2-5097-b1ea-67d7c64d1c0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:6758116a-97d9-58cd-976a-475de9d6e53f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:fe01cf7c-115f-5ff8-9921-143ae4c9b024", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:9d1de3a4-3d75-548e-88d5-8ec9fc2a285c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:b885f7c2-93e0-59a3-9a17-19b9d2d56744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:a8f61027-6388-532f-a1eb-1286983548e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:84275128-3857-585f-9166-60503df1ffa9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:746d6603-79f0-50b7-84fb-86aee4ed14ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:d8e4380c-7772-5aff-81fc-bb49e5184008", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:ef5bc40f-0075-5f04-853e-adc7998bf11e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:7c4100f8-c7b7-5bb1-b056-bf0524186d96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:575f50dc-6c0c-5a35-a2e2-9f5a8d81f493", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:090350f1-1218-5a2a-8f2b-e94de7e966e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:46feb586-00e1-52e9-bad5-b56a8171752f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:ba7d70b2-e35a-51a0-add7-9cdb16ec0ea1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:34235859-f1a5-5a60-9669-904df796b63f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:6b76c472-4929-56ff-b18e-812ecf57e93b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:a7a1a401-d828-50a3-bb8a-fba154270004", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:701bdceb-75cd-5654-b532-78c512fa9e0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:3817ea0d-cd0b-556e-8454-714a21083723", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:dd03a9c3-ab00-52ac-93dc-f8188349fbe9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.12 of @angular/core. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:35e4e722-189b-550a-841c-3baa21871fca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:5c1acc60-4e3a-50b6-b970-b19115d1fbba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:27d43fd8-4d37-5ee0-89fe-073b756c62ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88056 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:ba86c2a7-05c7-584f-92a2-37e90caf20d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:2ce5d546-7147-55e8-9fb6-f622583275d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:6676fc44-75fa-5566-9b0c-683c4d12f16f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.12 of @angular/core. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ], "bom-ref": "urn:uuid:aa286fb4-4275-5de2-80c7-18a10ad4b007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 12.2.17-tuxcare.12 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@12.2.17-tuxcare.12" } ] }