{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:25a6a9b5-f38e-56f2-b20a-f669a2e50ea2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15", "version": "9.1.13-tuxcare.15", "pedigree": { "ancestors": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@9.1.13", "type": "library", "version": "9.1.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:ebeb1635-1712-5e7e-aef7-c9c2bfbf6aa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 9.1.13-tuxcare.15 of @angular/benchpress, and is fixed in 9.1.13-tuxcare.16." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:6a6a675d-3835-5112-85d8-517ec668b350", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 9.1.13-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:28363dee-d0e4-5b0e-8377-c23235b7f5a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 9.1.13-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:6c709e8f-f1ce-5015-a1c6-bbfe93385937", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 9.1.13-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:5c26fc54-40d8-5a6c-bef3-40a80b42db58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 9.1.13-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:5b0de59e-9475-5768-96e4-9187414e26f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 9.1.13-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:8be6ad29-a5f3-55a2-8540-7068d58e5959", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 9.1.13-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:9ff010db-2ed8-5053-8e07-681e99da337a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 9.1.13-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:4d6607b8-028a-5128-889c-00fa6f2e9d55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 9.1.13-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:9280282c-6b17-57ff-9438-385024206443", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 9.1.13-tuxcare.15 of @angular/benchpress. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-54264. The target repository uses a fundamentally different request reconstruction architecture than the vulnerable upstream versions (22.0+). The vulnerability requires the presence of header-copying logic during request reconstruction, which does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:883abd9b-5c07-5a51-bf0d-6cd30e99faef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 9.1.13-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:3d89143b-ba44-5d40-9c2c-afb59737f1da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 9.1.13-tuxcare.15 of @angular/benchpress. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-88056. The vulnerability requires String.prototype.trim() to be called on URLs during server-side rendering, which strips Unicode whitespace and transforms same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable pattern was introduced in Angular v22.0.0-rc.2 (May 2026, commit 6e71049021) as part of a URL resolution refactor...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:ca5fee16-88f1-5766-a37d-227919acf047", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 9.1.13-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ], "bom-ref": "urn:uuid:d30fb258-1be1-522c-88d8-217838529a9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 9.1.13-tuxcare.15 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.15" } ] }