{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e6b16f2a-31c5-592d-bd14-fa0b0a7dfaf2", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2", "type": "library", "name": "@angular/upgrade", "version": "18.1.2-tuxcare.2", "purl": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f24ff105-5dac-50a0-99e1-711ade5d847f", "id": "CVE-2025-59052", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0329a228-64b5-5c9f-a4ce-0a0504e48f1b", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0072a0ff-0269-5e04-88d3-ec25215f856c", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:70ff9cf5-8c86-5b97-82fd-4a46a0ae3b1a", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0ca71100-1572-59d9-8735-601f70956b1d", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1c19c11b-a7ff-59a0-bc6c-f2c3a6653aa5", "id": "CVE-2026-32635", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e789b913-59ba-50cb-a617-e7c961b8756c", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:84e3a863-9ff1-54e4-85d6-2ca65b89b36b", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8675a0f4-ff17-5e61-b62a-7dfd9a99378e", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fd64128d-6219-56d8-8d8d-ed9f815d9959", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4b9a8087-1d54-5a64-8e95-1a046c3a0ec5", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:00c6dcfe-abe2-50e4-a2cc-35f171ed2403", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c3c2e950-c8b0-5826-9a04-e9bbfe179001", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:808ac0bf-2f54-5380-9340-6041cdb8c32b", "id": "CVE-2026-50555", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.2 of @angular/upgrade. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f3d23b1e-d121-5073-b48e-63a05250310c", "id": "CVE-2026-50556", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.2 of @angular/upgrade. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9187a300-7d38-5434-b9e4-d5a8ea88583b", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c5810506-9868-5be3-9d5f-93471204fc65", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fff5ca33-43c1-5fd6-b1f6-f2637a2335de", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:38beb849-e3c1-5f86-8a6d-3215b5eae1fa", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ab552739-d2b9-5b41-9963-e504da257e0e", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5578fd04-2d41-581b-8726-f9f2bd4f522d", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:41ab0361-c918-5a6c-9a5b-c4c93b11b855", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.2" } ] }