{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2a68543b-155d-5974-bf41-76cea2cf895b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17", "type": "library", "name": "@angular/bazel", "version": "5.2.11-tuxcare.17", "purl": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:aedb024c-ff80-59aa-b4e9-27429f8c72a3", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:e8692bf0-a394-58a9-9ba7-9f8b17e2df37", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:004361bf-bee3-5e66-a9c4-a38b90c06e87", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:1b81acd7-c314-56eb-99dc-280100a63ba9", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:fa92744a-583d-5010-9445-67c33be1af3c", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:eae85dd9-3d26-5bf0-85e1-b9ce52ca6f71", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:ef592c18-a3ce-5075-82d2-299b7c616255", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:c3424748-aee1-5889-b082-b7d81899d96b", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:e688f47a-45ff-55c8-92ff-9fce3e6b72a1", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:78fbfc11-e2ec-5663-b74c-6bebc33c6d03", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:001e4165-83e6-5093-8f7e-a7da85c159bc", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:2219d9d6-7a4a-531b-8078-e1b8f9984ed6", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:aaaf1677-4af0-5b65-9b91-e75592df3231", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:25c37895-56f3-59de-9abc-67380e515dd4", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:0ee2f3f0-b1c3-5fe0-ae0b-a7bcc0760a1e", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:85bd4f29-e11e-5147-ab19-552df42cab79", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:a8c7c2ca-1901-5ecf-9372-59999e26a478", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:b0f10a38-d8b5-52d0-bffb-300c38571204", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:10436d0e-936b-5ab1-906f-77a3596d4c19", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:25eb5cd5-adb6-5304-b841-59bea607fa92", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:0c378a09-3dae-5925-b7da-fb056293f979", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:26ae6ba5-8c27-567f-8f16-a6cfe645ead0", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.17 of @angular/bazel. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:f1b0f643-c56d-5abe-8ae6-0befd9d96b77", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:d3cda9a2-1df3-54eb-a446-f533e43a417a", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:6a8b8cd2-cdea-5006-8f01-89f1b5e1ce2f", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.17 of @angular/bazel. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:d93cef57-1241-5d52-8526-bdbefbdc6105", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:9209f16d-eec9-55e6-a544-42d225c8c60e", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.17 of @angular/bazel. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat..." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:7fe0461b-d287-5b7f-802c-baaac424d9e1", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.17 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@5.2.11-tuxcare.17" } ] }