{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c37ce533-8a2c-5e6a-b333-b01fdf9405a1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16", "version": "9.1.13-tuxcare.16", "pedigree": { "ancestors": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@9.1.13", "type": "library", "version": "9.1.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:6520b3a7-5914-5f8f-87aa-0352246794b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 9.1.13-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:37ecab07-0307-5781-ad1e-2ffc3aa05c9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 9.1.13-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:993a157c-1c92-5933-915f-cc02307ab6a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 9.1.13-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:09e7ba64-5c5a-5757-8417-f276dd886be5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 9.1.13-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:f2f8e037-6a01-5ee4-92d7-fe1dfbbc64e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 9.1.13-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:2626054a-dd5a-54c0-ae27-b8d7139d45fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 9.1.13-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:8f859df3-9bf2-58af-97b6-2dc6b6600ad5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 9.1.13-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:205955a3-4687-5705-8cef-d38c9a43c4a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 9.1.13-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:2bb85d72-9e2e-5587-9c44-dbbcf0ac2111", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 9.1.13-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:ed84d681-243c-5cd9-9a1d-52017b78bc8b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 9.1.13-tuxcare.16 of @angular/benchpress. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-54264. The target repository uses a fundamentally different request reconstruction architecture than the vulnerable upstream versions (22.0+). The vulnerability requires the presence of header-copying logic during request reconstruction, which does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:2aaee594-0c4a-5093-a79d-1d2e80dde421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 9.1.13-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:23f108b9-312f-5510-b7bc-a8bca42bc838", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 9.1.13-tuxcare.16 of @angular/benchpress. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-88056. The vulnerability requires String.prototype.trim() to be called on URLs during server-side rendering, which strips Unicode whitespace and transforms same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable pattern was introduced in Angular v22.0.0-rc.2 (May 2026, commit 6e71049021) as part of a URL resolution refactor...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:51b251ee-5ba8-584c-9811-0577aa0f51d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 9.1.13-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ], "bom-ref": "urn:uuid:dfc4c928-949d-5560-9320-48f477577ff0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 9.1.13-tuxcare.16 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@9.1.13-tuxcare.16" } ] }