{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a9ba30e9-9697-594d-9737-32ae72908b2a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3", "version": "16.2.11-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:7a84e65c-592f-5fa7-97ca-33e49a5ad37a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:9a6a0f3a-5f0d-5df3-b24c-d52978204e3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:f05feb0b-dc1d-5eaa-826b-36b3278c3774", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:dfd22cb2-a13e-59e6-b4de-0e9328b86493", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:1caa16df-f574-5813-9dba-60fa0c7028fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:d1c674bc-0115-5f70-91e5-c5f5aacd2f02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:36fb22cf-4180-5e4d-96b2-3ebad3a86019", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:06dfb210-91f0-5197-a66a-33d1e6827948", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:11bf2736-d428-52cd-9a95-49f9ee0ce061", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:4f030ef2-6042-5039-8ffa-506bf4e397df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:c303d2bb-f9ce-5a5e-9a98-7b7f63d2eccd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:3dfddc11-64f9-52cd-83a8-ad60ee2a6ee0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:a7588c66-6915-51cf-8004-bf1500d45f9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:de93b199-bf19-51ee-9a97-efa5dff9e1d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:e539880a-9da3-5b67-a517-226ec3d00354", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:4aa59806-6376-506a-835b-cb63faf3b8f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:10cdd434-04d9-5d7b-b55c-91a44271b6df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:7192e08a-2b06-5a5c-bef4-5d9240946290", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:a86bca73-9eb1-527f-9577-3dac4c4689f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:f7c4cebc-8e18-537d-98e3-8fae199e84c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:f24839cf-6c08-5453-b6c1-e0c9b92e80a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:d869e3e9-276c-5733-9d3c-4c444fcb20e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:0a3d41f3-8add-5ca7-bb6d-1c69b705cfcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:e93e63a7-890d-52d3-a270-62e5ece46179", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:3b821f05-cfab-5911-bcae-14faf15fe841", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:1f7d24d6-efc0-5bac-9d45-ed32d759edaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:587b97ed-3456-57fd-b09f-3a1a6522a313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:4480abff-adb8-569c-b4e0-39b602218e08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.11-tuxcare.3 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.3" } ] }