{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4d4ee6f0-7794-515d-a7c8-c9616100bc57", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5", "version": "16.2.11-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f6d331f4-e3b7-5986-a7fe-87f3d1b61ae1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d73ca528-d037-5a52-88c4-691ad9e027f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c9e95319-2c6b-506c-91a3-bef8b3abaecb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:df6e3451-4b77-5965-8c36-f0d4696e8e73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.5 of @angular/language-service, and is fixed in 16.2.11-tuxcare.6." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:2510aee6-89c7-53cd-b4a1-e2f165a96c84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a7d8bfbe-03d7-556c-9a14-e8100f4185b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:88bbb252-eca7-591b-8578-0a72bf5e65a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b2aa24d7-65bc-5eee-97b8-c2163c7d2e36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:92b3a2af-7eb7-5ede-b967-2ed0005914d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:906a6243-2ec4-5624-a67c-87fceec69e22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b8238ca7-b0ed-5256-a845-8dde84b946ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:14fa12b8-f95d-5cea-97a1-63110070bf97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7f1aeeb9-9c70-53af-9f7e-b2a0a3a224d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7921b17c-f2f1-5a90-9c06-f24cdec95a17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b64a2648-ca80-53aa-9b1a-3187b24afd53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:228834d3-ace2-538f-8adc-b71a8036ec3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9d00cea2-087c-509c-b5d2-c67f7624194c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b0182d35-7da7-57af-8f32-90b9d4d3e06f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:fce1550a-3b3c-5bfe-a9d0-5eebd2fcfd26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:dbd82c12-c8d6-5678-ac14-05671de6c2a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8a23a0f9-a223-58f2-9b36-12c99b71d9aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8f616621-22e6-5973-ae46-2edabbe4ac49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:2a1358fc-f732-5729-90b0-e53a67593443", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:1ebf9619-a06a-5378-b664-d415e62babea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c091589f-a61e-5a6d-96b7-11c0eebe85e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a80186de-4b82-5da8-9238-14ad3193f9de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f3753eeb-897c-540f-9915-52047b0001ba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.5 of @angular/language-service. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d0d1fe74-5c8d-5881-ad43-0b58fac659e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8073b994-abf9-5f32-b3ae-cc68c20a934e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:427efb86-0151-54a0-bbbb-903d8ddf07e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:6498428a-1dd6-5c07-83a4-95d5db44b65d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.5 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.5" } ] }