{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f105791d-ec79-58d1-83ac-4f676d3c216a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16", "version": "16.2.12-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4658005c-8794-5ceb-af30-d907af9d8cd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:a6a3421b-4ca6-5f0a-8e95-3c78572359d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:5354535f-6d17-5c6f-8ddb-232ff5ea3a07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:48362eb0-5cbd-5f93-863f-29cc67971d15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:644dc61d-96b2-5db3-9536-8cdea0167113", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:adb20837-9689-5b55-af77-331534479ed6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4be23e18-a529-5a35-9999-e27d23d041ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:facaf820-4594-5d57-8645-cd09e3cfdef1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:0ebb40e4-b2df-5a30-953d-f943d1b7d22f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f4d70519-b6a1-596c-bb22-dc1b473c6824", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:19a1a697-e4a9-55ab-9b8d-118043e984ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:c48d72d6-34f1-54cb-96e0-adb235043b43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:902bd673-1df5-5f68-b564-760b2a10cc40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d48eca52-e938-5d13-b766-87d029dc4dfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:aaeb249e-fbca-5a80-94cd-1bb1e17f5f4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e2823017-2b5a-52fe-a9a3-5ee3b997d8fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:fb8a9936-feae-5436-9363-bea55d534d9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:9b3b6ad6-99a4-56e0-aa46-1bb070cc0d83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:45ad7030-d0d6-5276-9590-cbaf49224fdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:23d39063-b0bd-57d4-9cdb-db5d2bbdf643", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:3c47e248-1794-57c9-a88b-c2ea66a70944", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:061fa7dd-b641-564a-b582-314708c208f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:085a89e1-5636-5263-b27d-f56c34e71dca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:be4ce4cf-8eea-558f-a497-45768172c5d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:3c1cf8cc-8d24-502d-9ead-d0a97cd394c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e58955f1-9aad-5324-9a2c-a3b2952b0bf5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.16 of @angular/language-service. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:c6ea801a-a9fa-5f02-9b07-27beb1a612fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:9047ab63-4ce5-5a95-9318-67d11c38199e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:3fc67284-8be2-5200-9a43-5fc6b4364c16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:c4fbcfdd-e61f-55d7-8ec8-8e8b96c1b822", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.12-tuxcare.16 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@16.2.12-tuxcare.16" } ] }