{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ec52aeda-8f5b-5d79-91e4-8c2b591c3423", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15", "version": "16.2.12-tuxcare.15", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:16259c24-98d1-5abf-8d5f-9e6aa0bc57b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:73242e0a-042f-59bf-8c67-799bde8f8261", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:78afa8d4-91b5-55f6-aacc-0e451838bca2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:a296a717-26b1-5556-accd-5c01024f11bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.12-tuxcare.15 of @angular/upgrade, and is fixed in 16.2.12-tuxcare.16." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:6b9101a8-a75f-5f8c-bdfc-af9ee3ea9010", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:17e3d1ad-d7c7-5b5e-a609-095e2188e89d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:4d0cfdfb-037d-563f-a6c5-74e0b8b5e37a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:cc1d63cf-ab7d-545b-b260-0ec43e0d32ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:a75fea23-1c6e-59bf-b98c-f767cddc332b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:ae79ec82-1ea0-52c6-b69b-2a219b43fb58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:547bc101-0a8a-536a-a946-75bf45a1600f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:7a5b820a-7f13-550a-97fb-2f2596e5a3c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:c10da619-b0c5-5191-be2d-43dac3615ef6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:d89908d5-524d-5577-8ef7-a76a3fa1b58c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:89da9b68-716a-57e5-b064-00c5a7c9d147", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:60983ded-ca0e-549e-9759-c45008d86368", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:ff05349f-d3c2-594f-8515-008a6c6dbbea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:733722df-1c03-5dd2-bb51-d5db4d59b9fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:4b7156b1-9c27-53ec-bbf9-3cd42ed9ceca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:908e43a1-51f9-5202-a9d2-34b2dbad9455", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:b99a0641-134e-5782-b94d-8cc8fe1c1291", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:36415597-49f0-5988-bf5b-d8fcc4a3cbcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:a47922ab-9bad-5804-9b7e-bf7c4ca1176c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:97e36f7c-fc8e-5097-9e5c-c175fd3533ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:3f9f0222-974f-5bf0-85eb-c23151dc94d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:fb561229-7293-5557-b669-2ad49a7da925", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.15 of @angular/upgrade. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:a4e230a1-d83e-5624-bc5f-4119baf83d4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:194dfda5-9e33-5c29-be2e-471d7fc0a132", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:c3c4a979-57a8-524f-af6d-cbe43310fb8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:a8aeb11c-3243-5220-bed3-3e5fbac2e642", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.12-tuxcare.15 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@16.2.12-tuxcare.15" } ] }