{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f87cfab8-6568-52b3-bf7c-3f609f766fe9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6", "version": "16.2.11-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:45b42388-c58c-5624-864d-bd5bc5c33e22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:03d263d7-59b3-5038-b9c4-4df31b0c352f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8c1551b0-42f7-5c7a-b6da-2c1035ed52b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:77189f6c-ca56-5cff-8f54-59d5676e87ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cad4b018-e53d-5f95-95c1-8ae775f0ed3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c1bbd463-2f10-524e-9c3a-c9ac2a6c3ac1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:932dc22e-c8a1-5ec2-9831-3356d9195ce6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:61cdc59d-bda1-5035-9e16-aef54971163e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c48ed728-ec51-54bf-82da-365256e61e59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ccdf1499-c631-5721-91aa-e180297b9952", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bfcd5030-def3-5a1c-99b3-c1fc0385cd25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c0ed92c4-6013-5b43-8127-2cf3fc1c7ccd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:eb16e637-b3ac-5bf4-a4b9-0fdc403f2592", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:612ce55b-7725-539e-9865-2aad268a0166", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9a729380-685f-524f-996a-71c377b92aa6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f447cfed-7265-5017-b690-07bf339de1ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:61adbd11-5f4e-56fd-a26c-f14dc5d33ec0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bac76b70-f67c-5d0d-81e6-4b8a8f540f44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:97185d74-9326-5e41-87fe-ffa44415eebe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:15c315b9-7884-5636-a411-849516a2d799", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:0d36d76f-76eb-53f2-912e-c5e5628a7cc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:256ffd65-beb3-5ae5-a9c7-0ee66976c0bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3e8e786e-2c25-5ce9-bef4-17cf3ad25082", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:72e53c45-0d90-528f-b163-907503db1a8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1bbd8ed4-6645-521c-bf6b-9fec195d0a25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3c6b4c8a-1508-5166-b5d4-33bc5e0ceb0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:39180736-c114-5414-a3a0-aa5b3899069d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.6 of @angular/upgrade. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:84384e9e-c0b9-5bc1-a738-4f5f86705069", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b04d71f6-01af-5710-9ae5-57564c87036a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3afe33e4-1362-551d-b059-38c5665e2d34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a5f7f29e-c207-5814-b68b-d776943bd3ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.6 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.11-tuxcare.6" } ] }