{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a082cd44-ca91-5b63-878b-bf129f3b7d10", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@17.1.0-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7", "version": "17.1.0-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:a96f29bf-9782-519f-8357-578d478c27b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:52f9caef-8b9e-5453-9582-d4d2c9f6fe79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:1e96f6dc-cd69-5b07-94ad-ee9fae0debd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:490f565a-3569-53ce-98e2-6a43f7bfdff1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 17.1.0-tuxcare.7 of @angular/core, and is fixed in 17.1.0-tuxcare.8." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:1149116a-2815-52c6-9880-b2ea3ac08593", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:4947fb7e-5696-5273-9069-2c6878abe5a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:1b95a709-3829-5a06-aecc-7ac2798cc11f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:bc6a1e82-ced7-55c8-8321-24b289c77413", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:13c80f64-fab0-5c16-8b17-6770fa060ce8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:86ce8429-5f40-592c-9709-4e63a0bf05f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:3f91a72c-a3d2-5270-b92b-0f327404c25d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:6df22c49-aaa3-548b-8109-cc148413bff0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:cecaeb4a-f7a3-5905-a188-95ed81b3607e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:8f15d6c2-70aa-5dea-b5f7-8712ddf147a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:42a325c5-91aa-5a31-b3fc-dc72868ec647", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:f9a981c6-cb5c-5a09-b200-7d37afbaacce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:4d5f9ee7-5284-5ef6-b9a7-1f45b3895ee0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:e83da366-8df3-58a9-bafa-ce52c175bdd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:e5824bab-9e1d-5816-95b5-1caa53f3f6da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:cb5b9de5-f479-5b54-b2bc-7673dbf690ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:c35526d2-511d-577b-970e-2cc8f8a2e84e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.7 of @angular/core. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:9ee3b4aa-b992-580b-9b52-8dad24277329", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:77c547c6-9eb5-5b44-87bd-d26e74d01c50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:196776c4-7625-5b34-89cd-cd114c4b2570", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:e35862c1-62da-5de5-ad59-e186289f26c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ae56cfb3-1f08-5fcc-96ad-45f496e04063", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ab499ac0-5529-556b-a63b-28f79821bf84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:1a087d64-a16b-567d-9e49-3e63e6de925b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.7 of @angular/core. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:364ea46b-a552-56fb-a18a-1d1822b54073", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:16f79609-557f-56d3-a3f3-6b82ff98ae87", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 17.1.0-tuxcare.7 of @angular/core. not_affected \u2014 The Angular repository (version 17.1.0-tuxcare.5 at SHA 1b802ce320) is not affected by CVE-2026-88058 because it does not contain the vulnerable source code. The vulnerability exists in the domino library's HTML serialization code (lib/NodeUtils.js), which Angular references as a dependency in package.json but does not vendor. The upstream patch (89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef) is a D...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:3cbb6b5f-1c4b-5878-b709-6c9b8b4db428", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:e9cf9d9f-a5c5-575e-94b8-2d6768dd93ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.1.0-tuxcare.7 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@17.1.0-tuxcare.7" } ] }