{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e83f7074-94fe-515a-9eec-8e6cc56d9ec9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14", "version": "9.1.13-tuxcare.14", "pedigree": { "ancestors": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@9.1.13", "type": "library", "version": "9.1.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:49444b97-3657-5e5f-adf5-48e77b497740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 9.1.13-tuxcare.14 of @angular/benchpress, and is fixed in 9.1.13-tuxcare.16." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:ebfceebc-fbdf-569d-81f8-1da0eab38aaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 9.1.13-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:9faf3499-be6d-5f64-bbaf-0cc9793e5563", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 9.1.13-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:5a628f4d-b81a-5130-a8fe-66832cfe7309", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 9.1.13-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:d413527a-5ce7-5feb-96cb-dca7789b0e01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 9.1.13-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:93b8e883-d83f-5e6a-bee0-d935c0e97bad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 9.1.13-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:b123c0e7-b5a2-5902-bd9d-134b9f6187d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 9.1.13-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:7251816f-f7f9-5ad8-afc0-4031162380d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 9.1.13-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:100bdd3e-667f-5391-92a6-485a1fee9aff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 9.1.13-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:4012fee2-5378-559c-a620-52684b8c0d32", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 9.1.13-tuxcare.14 of @angular/benchpress. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-54264. The target repository uses a fundamentally different request reconstruction architecture than the vulnerable upstream versions (22.0+). The vulnerability requires the presence of header-copying logic during request reconstruction, which does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:cf567522-24f5-5c61-8e5d-fb0a3dbd9d4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 9.1.13-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:4fa05557-07af-5eb2-ab97-672e09d7ce08", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 9.1.13-tuxcare.14 of @angular/benchpress. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-88056. The vulnerability requires String.prototype.trim() to be called on URLs during server-side rendering, which strips Unicode whitespace and transforms same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable pattern was introduced in Angular v22.0.0-rc.2 (May 2026, commit 6e71049021) as part of a URL resolution refactor...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:785c5d70-2f36-5de6-9796-2790632e68f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88058 affects version 9.1.13-tuxcare.14 of @angular/benchpress, and is fixed in 9.1.13-tuxcare.15." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:dad05ab0-2667-5350-9813-c150ab9955b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 9.1.13-tuxcare.14 of @angular/benchpress, and is fixed in 9.1.13-tuxcare.15." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.14" } ] }