{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d0aef642-161a-560d-b638-a20bd5341820", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13", "version": "10.2.5-tuxcare.13", "pedigree": { "ancestors": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@10.2.5", "type": "library", "version": "10.2.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:3bef464b-9990-5234-ba49-65dcc993aac8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:2fb9e7c9-96fa-5bf2-9b15-af48057dc73e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:58e5c8f2-36c6-5e9d-8bf8-51630292e57c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:4d94b7b1-6075-5de7-a4bb-03d0d2e1f7a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:c3328893-496e-5f15-8882-051216525b3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:de31b62d-8be4-595a-9d97-61c150edbf47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:4c5996db-03af-5c6b-8a3d-9f1354bcd5c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:7bc8f6f2-d409-5a9a-85de-e4154b621fcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:4b239a49-cad1-513e-a6b0-90f025303945", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:c6c16ef1-6302-51a3-ae92-71f5754ecda7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:df2e92cf-787b-5c90-bcef-8b81a9310558", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:c5a2dc64-c6a9-5111-a478-ed05cd024f9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:925fa41e-abf6-5b0a-bae6-722a7bf0d913", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 10.2.5-tuxcare.13 of @angular/bazel. not_affected \u2014 Angular version 10.2.5-tuxcare.7 is NOT affected by CVE-2026-54264. The service worker in this version does not preserve request headers when creating network requests, making it impossible for sensitive headers to leak on cross-origin redirects. The vulnerable code pattern (newRequestWithMetadata with header preservation) does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:e3013811-efe5-5a03-8f59-9686a8033ff2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 10.2.5-tuxcare.13 of @angular/bazel. not_affected \u2014 Angular 10.2.5-tuxcare.7 is NOT affected by CVE-2026-54265. The vulnerability requires the Ivy template compiler pipeline architecture with separate TwoWayProperty operations, which was introduced in Angular 20+. This version uses an early Ivy architecture where two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings, automatically receiving the same sanit...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:c8c96f48-9379-52c3-a5fc-19d92772f745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:6d80b6bb-9cdf-5260-a792-c35956ca157f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:e64c9961-df80-5bfd-8ddd-eba1818c62b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 10.2.5-tuxcare.13 of @angular/bazel. not_affected \u2014 Angular 10.2.5 is not affected by CVE-2026-88056. The vulnerability requires a `String.prototype.trim()` call in URL resolution that strips Unicode whitespace, converting same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable code pattern was never present in Angular 10.2.5 and was introduced only in later versions (Angular 19+). Without the trim() call, URLs with ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:badb52cb-139a-54f1-942a-dbd9f5024ea0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:c4f6f60f-7ab3-5707-a716-4cc4526d7a9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ], "bom-ref": "urn:uuid:b9cfbc95-4733-56f3-9260-ab167dcf1ee0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 10.2.5-tuxcare.13 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.13" } ] }