{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:738480a7-717f-5c3e-891a-7cea9cc4f673", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14", "version": "10.2.5-tuxcare.14", "pedigree": { "ancestors": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@10.2.5", "type": "library", "version": "10.2.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:31e3faa0-582f-59a3-b28e-46fb5a55f7f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:50c14b03-773f-5d73-b635-ca98b1936702", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:2cb922b4-a8a8-5238-9c71-0ea891ff5a1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:82b37746-f385-5aa6-b90d-a94797237860", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:c2fb4a76-84b5-5e04-890f-32b61b445534", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:681d676e-dbe0-5d8c-ab6d-ae9a8de886e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:aef7ca72-86ab-5c7c-99b7-d1ba11b1b293", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:0a7337df-410c-5666-935b-a76f356029f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:d033c780-39e3-5f15-ac7e-379938455166", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:7a879e7d-594e-5524-836d-9a46fd348766", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:424be878-40c1-50c0-9274-122810ec6ab7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:69f28f7f-e57c-5a1a-81b6-3c037af302fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:0231eddf-1bd5-5398-82be-cadfd0f72a24", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 10.2.5-tuxcare.14 of @angular/bazel. not_affected \u2014 Angular version 10.2.5-tuxcare.7 is NOT affected by CVE-2026-54264. The service worker in this version does not preserve request headers when creating network requests, making it impossible for sensitive headers to leak on cross-origin redirects. The vulnerable code pattern (newRequestWithMetadata with header preservation) does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:a6f5c2f9-3d61-58be-9682-84d24b3cf0cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 10.2.5-tuxcare.14 of @angular/bazel. not_affected \u2014 Angular 10.2.5-tuxcare.7 is NOT affected by CVE-2026-54265. The vulnerability requires the Ivy template compiler pipeline architecture with separate TwoWayProperty operations, which was introduced in Angular 20+. This version uses an early Ivy architecture where two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings, automatically receiving the same sanit...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:9c7ba5e3-c679-5a79-b999-77ee366bdae1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:7584c1b9-fbd2-5db2-986f-a27ae7fcce94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:b40add92-ead8-5d19-9102-90a2d7253c57", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 10.2.5-tuxcare.14 of @angular/bazel. not_affected \u2014 Angular 10.2.5 is not affected by CVE-2026-88056. The vulnerability requires a `String.prototype.trim()` call in URL resolution that strips Unicode whitespace, converting same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable code pattern was never present in Angular 10.2.5 and was introduced only in later versions (Angular 19+). Without the trim() call, URLs with ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:a439ef03-df61-5368-babd-db244d7b77ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:504cc35b-e8b2-5ac0-90f1-5d636213e475", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ], "bom-ref": "urn:uuid:747c15ad-6290-593d-b787-97da506f037e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 10.2.5-tuxcare.14 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@10.2.5-tuxcare.14" } ] }