{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:126b50e0-6633-5f20-85ee-9cb44a2d4c70", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18", "type": "library", "name": "@angular/http", "version": "5.2.11-tuxcare.18", "purl": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e1c615d8-fcac-5cf9-9d35-c52742c2f18e", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:24bbe437-be35-5a88-a2a7-d81865758ace", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:e52977a9-3b7b-57cf-bc92-ee736e04616b", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:81b7ebc5-40cb-5509-923d-d8aa3d770046", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:156cb1de-913f-53f5-b981-a13113487720", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:e2bd40b0-5a37-5e0b-bd88-c2f31e0470b2", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:c227a3c8-7131-52f1-aa35-431de1e05021", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:8bbf9a95-7030-57ca-ba43-fe57409f1792", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:78cfd765-70e7-5ce3-9202-b78e942d1a7f", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:2b77629e-f654-56b4-accc-f23243fc99fd", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:42055cc4-78de-574b-847d-fbffbf3116f9", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:cfb7273e-9252-567f-bb89-02656428461a", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:0ffe0a4c-613a-513c-8db3-69f6426b9dc3", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:b6530bc7-b744-5f1a-919e-0070131a260f", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:b12f1ab4-ff79-5d86-8f4a-cc37cac0f51e", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:9c78959a-b986-57cd-8675-550365be165c", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:596967ff-7a48-50b7-8466-da069d28f096", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:00ce5e90-7f9c-54d6-8636-5f302375a969", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:a7f3b88d-758c-5d75-84bc-dea9aa718575", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:160ad502-1822-5681-95f5-dfceb21fe68e", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:37e3954f-3c52-546d-a982-75332ad47a7f", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:e8ae2bee-d430-5b00-88ef-34ce7d727b8b", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.18 of @angular/http. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:9fd3fecb-0620-545b-b63a-3415d2cbb8fc", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:d0862016-2032-58fc-9edf-bf5cdc0f3d01", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:7c23aebe-7cbb-5083-af52-f5c2a10a0a19", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.18 of @angular/http. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:f6ea75b1-7426-5d68-82d4-56e7e6ee9875", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:1762c339-e57a-5922-8451-6a76f6d512c2", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.18 of @angular/http. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat..." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:e1e325f6-f619-5333-92b6-a7d5f7bc3ef3", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.18 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/http@5.2.11-tuxcare.18" } ] }