{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f82f9662-c70e-527d-ab5a-df3838b8f592", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16", "type": "library", "name": "@angular/language-service", "version": "5.2.11-tuxcare.16", "purl": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:66b3170b-8c80-5277-9cbb-54d89d1fe286", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:8802b552-0ac6-5989-aa95-9feb2153eed0", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:25b91610-af18-55e0-834e-a08a9ea41c26", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:599c1539-da93-5f00-ad30-d32fc04349b7", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:38595e43-d5bd-5d7d-aa9b-d72057a4ad82", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:4d047f50-805d-57c4-86be-6bdd599c848b", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:a4b73003-4fa3-52c0-b43a-65acbc679dee", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:625ba9d9-0e86-5de2-9de1-3f10ee2b4e0a", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:1c769eae-f6fe-5452-9c31-c926f9b2e549", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:6c0ac80b-0ad5-505b-b124-f82e1cbdea3e", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:d7d2b2f5-ca25-5658-a668-0c24c1bf7981", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:558617ef-ed06-5bbd-9bab-d49a454c44ac", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:0227827e-cee0-53a3-ba04-a7277f42d9f8", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:bda9da2e-94e1-597c-a0e1-caf9acd50b24", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:295812ad-d36d-58ec-8026-c722f7c2f0c9", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:01b273d6-5b3a-5dbc-bb78-076e4a4e567d", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:0928f176-6d77-5319-b54f-a20a4440b171", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:5b4982b4-64d2-5678-a922-fb4a1aaa7e8c", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:327eedc4-fe1c-5f67-ade1-d5ea881fb409", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:deee0118-cfe9-5391-b1f5-0cf149d335f7", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:f62c6a62-36b3-5cd1-a4f5-857c0f934df3", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:4b773268-aa96-5d03-8873-7284f61f4f78", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.16 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:af583e53-5666-56d4-99ed-a76d4969b6ce", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:4f2b0d03-0496-5868-81e9-020c4d70c6a7", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:fb7b4615-3c36-53e7-901d-311c8702df72", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.16 of @angular/language-service. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:cbf58429-161a-56d6-b834-88f0772998b4", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:619ed75f-c5aa-5146-98c0-c3a7121160fc", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.16 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:3624d56b-d679-59ef-a1a9-5067472e932e", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.16 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.16" } ] }