{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dbbcd7bb-b536-5cc0-b531-1c10a0a0efc4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5", "version": "16.2.11-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b9cb1521-1561-5fd0-94f0-134fb127c128", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a64b4762-5c36-52b0-b172-93cfc44d6831", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:aa9fdb22-cd03-57ac-b196-c0473903c5f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ab4d3316-21c8-5b3b-be15-73948069e986", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.5 of @angular/upgrade, and is fixed in 16.2.11-tuxcare.6." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:3f63859c-b168-5470-8d56-96b3f5b99fde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f9f05eb3-6a8b-5d0d-bf7b-dd96aa97ba2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0678795e-fb66-512d-b7a4-8ac07861bff9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:fde0b31a-0943-5d4f-b0f2-85cbd455ae01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:128393f5-6d2d-5d35-8454-aa9bd32845ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:49c1f047-3365-592c-9a3e-6b27195d5704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:aa7d3169-5b2b-5372-824b-cee559690967", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:94114b13-a7cd-585f-8a00-d40b6484ffa4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:29124008-d608-5d94-b2a4-ae61c68eb781", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a314c322-9a31-58bc-91da-8b07f5365a24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9c856e98-85b4-5d33-82a1-b0cdcf3cbc81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:cdf67a17-68f8-55ba-91bd-036708e8bca6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:56ebda8d-b5f1-5833-a08c-b66bd1bd4003", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4ce67f95-3ff3-5168-b120-05fb73908761", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:75093dfe-24aa-59f9-be08-b0e9bad0062f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:20ecc6bf-6cab-50f3-8680-0eeec7809bd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a4f307f0-0737-5b6f-a3b8-f0bde3d75134", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:329b2b15-7c6c-56c6-8d2f-86adec6e5ee7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4a084acb-1c34-5da7-88f7-3961c6452447", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:850a37d9-4dd9-5f48-b349-4f592be65e7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7df6c03c-8ff3-5d18-b11d-92ff63aef97f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c51dcd7f-be97-571b-a3c6-2062c5f81434", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:6454d776-42ab-502e-880e-250ca08adb17", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.5 of @angular/upgrade. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:69cdbc1e-ffac-5c66-9179-7b6889c71034", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d3d95a28-164d-5ae8-957a-f010184ca020", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:e40b4668-a9d5-575e-86f5-4705cb2bbbe7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c1a4d39d-7cb4-582c-84cb-fd4367dd17d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.5 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.5" } ] }