{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d2eb4693-d9b1-5572-b747-085b57bf822d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/benchpress",
      "purl": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6",
      "version": "7.2.11-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/benchpress",
            "purl": "pkg:npm/%40angular/benchpress@7.2.11",
            "type": "library",
            "version": "7.2.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101895",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:93bd4372-7c7b-5330-b8a0-5f6b26ab7831",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-101895 is fixed in version 7.2.11-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ad6a30a1-f2f1-5c55-974c-0389670e4c5b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 7.2.11-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-41423",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ff46a0b0-fb76-5390-87a9-0958a6dc359c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.11-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f432a903-1efd-58f9-8c0c-7bdb7e176ab1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.11-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:28cf925f-6391-5ffa-aa12-67492c729e65",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50168 does not affect version 7.2.11-tuxcare.6 of @angular/benchpress. not_affected \u2014 CVE-2026-50168 addresses vulnerabilities in the WHATWG URL-based parseUrl implementation and allowedHosts validation feature introduced in Angular's CVE-2026-41423 fix. The target (v7.2.11) uses a completely different architecture with Node.js legacy url.parse() and does not have the allowedHosts feature. The specific vulnerable code patterns that CVE-2026-50168 patches do not exist in this ver...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ad817f7a-59d9-5bd3-9454-050f1e1da633",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.11-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2489630f-e480-566e-ab7a-627e3d3a9fa4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.11-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:d18aea99-5833-5541-b71a-612b679504c4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.11-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:bf555166-bbb5-5851-99db-ca6fad25706c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.11-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:afadad8a-387e-5d21-874c-34b5c77af2f0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 7.2.11-tuxcare.6 of @angular/benchpress. not_affected \u2014 Angular 7.2.11-tuxcare.2 is not affected by CVE-2026-54264. The vulnerability concerns sensitive header leakage on cross-origin redirects in the request metadata preservation feature. This version predates that feature entirely - it strips ALL request headers when making network requests for assets, as evidenced by code comments and the absence of the newRequestWithMetadata method introduced in...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:d28a8380-ab81-5fcc-b547-751e09c77e3d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.11-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c04898c5-2442-5306-aff8-c6214ff97c96",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.11-tuxcare.6 of @angular/benchpress. not_affected \u2014 Angular 7.2.11 is not affected by CVE-2026-88056. The vulnerability requires calling String.prototype.trim() on URL strings before WHATWG URL parsing, creating a discrepancy that enables SSRF. This vulnerable code pattern was introduced in Angular 14+ with a new url.ts file containing parseUrl() that called .trim(). Angular 7.2.11 uses a different parseUrl() implementation in location.ts that d...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88058",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:432cdf31-eb0f-5dc6-b354-735b30b4fbf8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.11-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4e753b94-fda4-57b4-9147-026d3c2b269e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.11-tuxcare.6 of @angular/benchpress."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/benchpress@7.2.11-tuxcare.6"
    }
  ]
}