{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f5960369-f972-51f4-a095-dab7c3b26835", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6", "version": "16.2.11-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:53d49386-6c9c-5bac-9752-3d39ad1ed12c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5d137d62-0e99-5a80-8efc-1cdc175a36bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e2dc760e-defb-554e-8913-c113de724a0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ee925ee6-306d-50bc-bbaa-80c87573af3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b8a20fad-cc00-5637-b1c6-ff374ee623e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a673a5a7-bb7f-50be-8c49-d50683147deb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:37c2fdbd-d62d-50b6-b020-d7e74e14a453", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3ba4c585-a483-5a33-9412-b335ca5f3ccb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bad962cb-f6bc-55db-8965-c8505b71a678", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c0b7d983-683d-547e-833f-56f3da7df3aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a708dc6b-651a-598d-aed2-c1bd2ee5c058", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1a866305-f5d4-5b61-ab56-ea3f1c30eebb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:11bb2b32-9664-5af6-b0c5-740784d70e5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:025ce8d3-6d7a-5178-b9ad-73d7d875a7a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a98dbddb-de87-5fe8-88f9-702841147b84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:697a4a6d-2a8d-5e65-8f38-3bf53fdd5b6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8c10d8dd-61d8-5174-92e7-6fe70a24f793", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:08f11778-3e88-5179-aae5-4773c9b32fd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7193fa25-2eb1-5fd7-bb60-fff8c1334b10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9e67951f-92c4-512e-a7a9-0a3b8b3443ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1d40badb-b96b-5bd3-a8a5-1031d7c60106", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:75c67595-ab2f-58ea-8651-4dd8fd4d8645", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f592ff31-1d16-528d-a793-d5a1273d498d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8fdc1be8-2267-55ac-a0cb-334eec21a1e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1ad8f839-b031-57b4-9c0e-b7c536d638c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a91fa554-14a9-5d24-b56e-535724b469e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4188e90c-2d6b-5d31-a274-72dd9ea95f5c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.6 of @angular/language-service. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bd037bcb-349a-59f8-924f-c1f39e6915e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:386e5d68-2f32-52c9-8e69-a3139b1249e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f31109ee-d5f9-52b8-9d24-bf112351ce55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b3a1cca5-14f3-556f-aab8-d1116cd9eb0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.6 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.6" } ] }