{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:eb06a882-29c5-5fd8-8c64-1f5bb8c53096", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/elements", "purl": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5", "version": "16.2.11-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:777033c0-e55f-5ee7-84be-3fb81c80eb46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f2c9f631-4e24-56e2-974b-39e18229f762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7e6138c9-93f8-5394-adaf-629415052747", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:49b41439-0311-55bc-b9fd-e1492899b421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.5 of @angular/elements, and is fixed in 16.2.11-tuxcare.6." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:99a5aed9-5a6d-5343-bdef-87fe07ff482d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8f4630d3-833a-5e8d-af8e-a07b12c8f644", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ad865bf1-6e12-5087-9d77-c7a37ae2d1c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:1a63898d-284a-50c5-af9f-a7d4240e9e35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a9f4f0db-e051-5455-b9ce-52b43ac2c7fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:664e2322-baa1-5d8b-be09-84f79084150f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8e2b842d-4d50-518d-826a-93a6b125b8d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:38291789-66c3-574e-9e05-fdd7fc21f8e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:eb059e97-6594-56fe-a09a-b8650006bef4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ba47a4c2-00b9-5abc-9686-e92f45c68354", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f815fca6-0fa1-50f3-b0aa-308400a53e72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4f66e687-d515-5f57-8c14-22760f6ac25e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:801e15e8-292b-5c31-893e-39941dfe273b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:1ccae091-5800-5109-b805-4a133d5ecc8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8ab1ab2d-208e-59c3-bd53-ec57f5dcccdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5353aee8-45b0-5e1a-b158-03b620cd4f4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5f359b44-afaa-5722-99d1-1efc3a0dd507", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:96f12938-e203-5d54-b087-be1b8d10d5b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d091444e-2d06-5ac4-82e2-1caac7e01d08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:6197fbe9-2646-57cf-b140-75c6e78c8655", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:2bc6398b-d73c-5766-911e-086a53dbf779", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7016241e-5ce2-5334-8934-134a143b593a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b18a1bdf-0201-5c7a-b2d8-a9317316916a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.5 of @angular/elements. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:3039e6ac-30d8-5b8a-bf08-2bc0d15fead5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c7fb1f68-9345-545e-afdf-c5c4b66c3dc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:79fc0396-3c46-5b1a-82e7-52bb7dbf3711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c0c41979-a22e-530b-959d-b4d0c6cbdb60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.5 of @angular/elements." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@16.2.11-tuxcare.5" } ] }