{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3aa44469-1b4a-5238-a69c-ac2799372b12", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18", "version": "17.3.12-tuxcare.18", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:586ecec4-a688-565a-b461-1f4c8650ca07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:24d43c49-46da-5717-a00b-ca518a0b7ec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:b95c3d1e-85fc-550a-8952-c87f57e1d784", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:6befad50-4f0f-56dc-9cdb-5aad9dba3b1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:63352888-18f1-5406-9a58-50cd887e1843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:c234a194-6fea-5f0c-855d-05605c415f78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:94b90430-42a6-58a2-9925-851645c6d9f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:ef9e0313-8718-571d-a03d-b5fee75a65bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:f23fc482-934b-5944-9d9c-14dd4ec2745e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:21700a97-1c09-52b1-9025-63deb1488c87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:b89fb16a-b3f8-52b1-97d3-2aa69b2a2d0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:1cd4c711-02ec-5cc6-9c91-faf7f06695a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:043fe968-e5f7-5ef9-9c21-7da1da085d83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:e20e1f40-a573-5002-89e6-c4711ec7469b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:a6fea45f-0a3f-5d0f-8b4c-5c6c892146e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:589b36ca-37fe-5b59-b28c-a2ad4cc5df3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:d3b35180-01cc-5a44-8e43-99044e726ee4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:0dc97546-2519-5daa-a95b-5a91bac4c609", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:ddc6fe7b-d808-5797-8fbf-7c60e7a8c58a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:80b38e68-c5e0-5cf6-bf81-9714728b652c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:e5397b95-8ba7-5b99-aecd-3d64db4fbd9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:6f86ffb3-d97e-5e8f-a299-308d044b8e3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:dd710060-4258-5c79-9179-8023c99e3c2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:c1d00355-df2e-59fc-9d3d-ef85e39a650b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:1b6a3d71-264f-50c2-9f65-c0e09a29efe4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:1d7b7f23-e703-5bd4-9fba-4fdaceeb6411", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:6d34de4e-3f69-5d28-8281-d95ad654d8c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.18 of @angular/upgrade. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:3ba6fd5a-f4d9-566e-a6c3-e71de82cf1e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:9909e4fe-f12e-5f82-9fa2-442f748bf3b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:32139a3a-2f84-5e89-8aab-59b65aa3fc8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:c1493b30-9b1e-5168-9627-ba3adcbc55bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.18 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.18" } ] }