{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3522f9d8-0601-597c-b392-ef41a61f6bfb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15", "version": "17.3.12-tuxcare.15", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:d85c9d8f-98e2-5ba1-a80b-2db4f4a9f385", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:949b8715-d630-578d-8178-6dab90f2f79a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:c71062b1-4fc2-564c-8c8f-b91d2ac8b1f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:42b14567-0cae-5a35-95d8-fd12762a43e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:b9383202-508e-589d-8057-56ac2b5f0e6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:ac97ec43-e541-5c8b-a71c-849627570756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:e80dcbe7-ce14-5413-881b-fa68a0c360e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:ce9db4e6-db05-506d-99cb-8a5527c17de8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:81161b3d-309e-58f4-8649-41e98fe93cdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:27a2c7ac-1e97-5ddc-8d39-c817f9a4ad5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:0bc502ae-0894-5b3f-bc82-e9ed23faabbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:5e2d9e24-d1e2-5171-8b6f-5fd2a19382f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:2f67784c-d7cb-5420-aa7a-1554a0a113f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:8ede9a62-e578-5255-b169-49b27a65786c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:6693077c-1fc7-5d5b-bb4e-b6e9985bfb37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:c6cb1e82-a35a-5347-8cf3-09b75caf14ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:dc2b9d0c-12c9-56fc-9c49-559e27441629", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:bbd6ff55-e618-5c5b-9fbb-17ffe5ac5fe7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:e38069d9-3aeb-575a-90ec-ace7cf2417df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:202171e3-a817-5e28-8f5e-9ebf13f45ddd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:27076934-43db-5875-910d-ba6127457750", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:a56e6ab9-0dc0-5537-acca-778cca376d26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:53200c9b-0845-524f-a37a-dc33fab87eac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:37c37e6e-8ad7-5e76-86ea-0a0b0135bd96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:9fe56c93-34e8-5b37-b04f-46cb4de9e529", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.15 of @angular/upgrade. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:4ec49309-2d07-55b8-ae6a-038fcc718f53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:17c2f951-0363-51b8-8397-33f484c988ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.15 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ], "bom-ref": "urn:uuid:fe70f93d-bb9c-5f78-b68b-0d1581a14625", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.15 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.15" } ] }