{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3fb0a109-c2fc-50d2-9e85-27705a710533", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13", "version": "12.2.17-tuxcare.13", "pedigree": { "ancestors": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@12.2.17", "type": "library", "version": "12.2.17" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:fb839d0a-df83-5742-bd5b-5fda2e7f96ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:1819bc2e-ddae-5e6a-9884-aba3c1bd18b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:79eff665-da3b-5ebc-a9bb-f434dadd56a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:ae66c4c8-4050-5e5d-b102-bb2477a90329", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:85a85697-23b1-5965-9ba4-983e38a26f50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:dd3a6da5-a7de-516b-bd59-a33cd922f092", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:4cffaf1b-df3a-59ac-9194-6033ca843364", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:f14fa1e3-344c-5007-8c5d-04886864c827", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:f315d242-fa3c-5ea4-a1ec-be497619ad8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:b82b0ec3-9201-53bd-93b5-12f859b288fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:d126a7a5-f550-5a48-9aa2-0d1ec6868210", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:8a94cbf2-8f03-527f-9667-38d37b956477", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:ebeedc06-8be6-5835-a9f3-db4c89b4d799", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:e967480d-1bc5-52bb-8301-eece88fad6cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:244340b1-15dd-50bf-af0b-f8274ad633ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:adda182a-4a03-5e12-a58b-88963d3e0c7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:77142678-8a8a-5f88-923f-b6ef4a93bdc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:87ee5623-a881-5788-a506-ac99df3a8819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:3e49951e-33a0-5327-b5b6-069e46fc0fce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:e60df618-35c8-528b-999c-c9bab28389a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:17069e75-690a-5b0c-8335-1522ae164c22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:5ed667c1-6055-5ebf-b9e1-447bd2e30546", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:ff79f807-dfb5-5d8d-a526-204fcd2b4f2f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.13 of @angular/bazel. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:e6da5641-fcb1-5d15-8569-f22db87bc5cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:14c9ed23-33cb-5094-a4a0-3d1e39066999", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:44e5501f-3402-5ba8-9a1d-6aace2d15c9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88056 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:55b1b6ba-73c2-5a2e-b6c9-3ec95fb6155c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:1e3fa8cc-d74f-5af3-a20f-6d6dcfc49fe6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:948bd38c-dc2c-52b1-b8db-a143ac7bc524", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.13 of @angular/bazel. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ], "bom-ref": "urn:uuid:e5a1c034-14b1-5f96-8d4f-ebe8a9ac9c14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 12.2.17-tuxcare.13 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@12.2.17-tuxcare.13" } ] }