{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fb36d2d3-72cb-5f93-ba26-99e49838b00c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/http", "purl": "pkg:npm/%40angular/http@9.1.13-tuxcare.14", "type": "library", "bom-ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14", "version": "9.1.13-tuxcare.14", "pedigree": { "ancestors": [ { "name": "@angular/http", "purl": "pkg:npm/%40angular/http@9.1.13", "type": "library", "version": "9.1.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:9347f40e-035c-5a56-a7b7-053dd4f0d663", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 9.1.13-tuxcare.14 of @angular/http, and is fixed in 9.1.13-tuxcare.16." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:94546ed1-8762-525d-b7c7-130a89f3956a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 9.1.13-tuxcare.14 of @angular/http." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:2336d1d5-ab97-5081-ab56-3e54745bc710", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 9.1.13-tuxcare.14 of @angular/http." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:1eb127d0-2369-57e8-8b23-bb1cca752d7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 9.1.13-tuxcare.14 of @angular/http." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:235125ce-6274-5379-a4b1-787eada91678", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 9.1.13-tuxcare.14 of @angular/http." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:7f2adf72-a42e-588e-a874-bc451461709e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 9.1.13-tuxcare.14 of @angular/http." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:88f352ef-b445-5741-bab9-627ab380490a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 9.1.13-tuxcare.14 of @angular/http." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:44ae21d7-d9d3-5902-ae62-d6ae0fac0f72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 9.1.13-tuxcare.14 of @angular/http." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:e359d9d1-37c8-5d5e-b079-34a46cec9998", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 9.1.13-tuxcare.14 of @angular/http." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:425861d3-f400-5b3d-aef0-c2d9f47caff6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 9.1.13-tuxcare.14 of @angular/http. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-54264. The target repository uses a fundamentally different request reconstruction architecture than the vulnerable upstream versions (22.0+). The vulnerability requires the presence of header-copying logic during request reconstruction, which does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:0caa070e-4ee3-5b83-8445-2ccc13d0240d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 9.1.13-tuxcare.14 of @angular/http." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:50ef19e2-14e3-51be-816f-622a1ea92c5a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 9.1.13-tuxcare.14 of @angular/http. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-88056. The vulnerability requires String.prototype.trim() to be called on URLs during server-side rendering, which strips Unicode whitespace and transforms same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable pattern was introduced in Angular v22.0.0-rc.2 (May 2026, commit 6e71049021) as part of a URL resolution refactor...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:8e93749d-49c8-56dd-8cf0-8401d721854a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88058 affects version 9.1.13-tuxcare.14 of @angular/http, and is fixed in 9.1.13-tuxcare.15." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ], "bom-ref": "urn:uuid:f8e2da29-eff6-50d2-a99b-c1e503ee628e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 9.1.13-tuxcare.14 of @angular/http, and is fixed in 9.1.13-tuxcare.15." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/http@9.1.13-tuxcare.14" } ] }