{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:73c6da0f-89f4-583a-b4a4-d30895cd0dec", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2", "type": "library", "name": "@angular/common", "version": "17.1.0-tuxcare.2", "purl": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:bc7edcca-7f4b-5bfb-aa4f-6c78f28201f1", "id": "CVE-2017-16009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-16009 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:da32077f-4d47-56cd-adaf-53fcc04f1f88", "id": "CVE-2025-59052", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1fb0877a-76a9-50b8-b6f0-5c442a191366", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:600c84cd-f7f2-5c0f-8217-11230b6c4e84", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:978f081b-c261-5e28-a2de-bff1f3ce6c45", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a1bc4688-374f-58af-9d3e-9261f9287f93", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b76e5ad1-da50-5d24-85e9-0043e6e107c9", "id": "CVE-2026-32635", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:028c427c-649a-59df-8b7f-9d4eab5ca78d", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:24a289eb-aef1-532e-8f99-ba9623055db0", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:544498f0-98d5-5844-9357-9471cc5a261f", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7ee73589-797b-555c-925f-8d1f225cd5d6", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:089c38cb-4b42-5693-83a1-67267e11fc4a", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:06d4fc2a-4493-512e-83ba-afbe5be13a73", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:158a6d05-7783-528e-a391-bf5de793bb7f", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:87cc2a46-ac59-5a3c-8e3a-3e36b7015d1c", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0dd980f1-6353-5097-b1cf-1b7a411c0995", "id": "CVE-2026-50556", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 17.1.0-tuxcare.2 of @angular/common. not_affected \u2014 The Angular repository source code is NOT affected by CVE-2026-50556. The vulnerability exists in the external domino dependency (lib/NodeUtils.js), not in Angular's source code. TuxCare's own patch documentation explicitly states: 'DEPENDENCY fix, NOT Angular source' and 'domino is external/runtime (not bundled)'. Angular's code only imports and calls domino's API but does not contain domino's..." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:53c25941-96a9-54ea-92e5-a6d6d7c10854", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3e5c889e-4677-58b5-aeb6-3145df89cead", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:75b511f4-256c-5eb8-b2e1-c463fc3249f5", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:913d71b9-39b1-5422-9f72-dd0b77ab9979", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.2 of @angular/common. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:01f24d25-b876-516c-82b4-a0e31d1e48b8", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dd2248b7-e391-54e5-8445-728cdef9f89d", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:48bfc9d7-00df-583b-b6c1-15e76381f41e", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.2 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@17.1.0-tuxcare.2" } ] }