{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6fc78e51-0a9f-5aaf-ad17-0d7460a0e3c2", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14", "type": "library", "name": "@angular/language-service", "version": "5.2.11-tuxcare.14", "purl": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f3ea6d01-d24d-586f-94b5-e9bace53ff95", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:06df2373-15f2-5b00-85e9-5fe4ac223ef8", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:49e5f0f7-ef1f-553a-be80-ab929c6f47b2", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:dbbbc860-9bdc-52c4-99d6-29338fc6debd", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:138961b7-3bf4-57fa-8c8a-e59fe0179a90", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:fef06a93-6070-57fe-8d16-55ddb3ea6ad8", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:d98e5d80-3bd9-57ac-85ef-5647cdcbc290", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:d5bdf537-c8f4-5d32-a13b-61270e2541c9", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:fddc1547-f427-59f3-904e-e6aa4b562e3b", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:c157639d-141a-5b60-a8df-1f923dfc08c7", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:be504d35-af6d-5755-994a-1d5c122339d8", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:661f125b-dc22-50f3-a1d9-f31f6bb3b764", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:b257bf59-11a8-59db-977d-c4abb779ef79", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:09410489-1cec-56ba-9d76-8d8cadfae6de", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:95c29d72-c66d-597d-ada7-3b96d7e1ef76", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:7bd80976-26cc-52a6-91b1-ec10b32d2ce0", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:c1bd0753-7620-54f2-8797-c5bf4e778bc0", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:c1a65a3b-366a-57e7-8a7b-6d66916819e7", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:def3f775-1015-51fd-a27a-7b143cd5f471", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:e6126bb3-bce4-5f46-b13c-a3128d9b7fdd", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:b63a7d3a-e61c-5e82-832f-95d643b43452", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:c635d303-ae30-54b7-ac3a-b3eef721e934", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.14 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:24ce1ef3-884c-5a88-89dd-beaf0cf53b9d", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:a39ad179-ce76-5343-b94f-ff1732edf667", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:8c1d22ea-d019-5827-8608-65c57e1c19cf", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.14 of @angular/language-service. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:5a750ef5-6e30-520e-abe7-0c68fc6fcf03", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:9a4b7fe7-08c1-5f54-b8b8-0f03780b2da4", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.14 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:6d09d8c8-da7a-5ef1-ac3e-88bfe2a8059e", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.14 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.14" } ] }