{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a4bf0e94-8e98-5b90-8495-ce2d982cf49f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12", "version": "6.1.10-tuxcare.12", "pedigree": { "ancestors": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@6.1.10", "type": "library", "version": "6.1.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:08078dd4-21ec-564b-ad10-80f85429e45a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 6.1.10-tuxcare.12 of @angular/language-service, and is fixed in 6.1.10-tuxcare.15." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:ce9b2c93-6535-57f9-a232-e75363526bec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 6.1.10-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:43c17380-3ff7-5ca2-b33b-51ede944221f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 6.1.10-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:b5abe0b7-0a8f-5835-ac9e-b0a8c5bd988e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 6.1.10-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:eaa1c2af-0d30-5f51-9978-2db15057cccc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 6.1.10-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:62561735-f183-5edb-bbe4-78e53534121d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 6.1.10-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:dcb71dbe-d36b-5610-b971-a67eb427d1c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 6.1.10-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:6f577d1b-dd42-5607-812d-caeff69f3582", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 6.1.10-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:6038cb0b-a6d2-5463-891c-3f915f06b2c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 6.1.10-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:e4259bc1-f1cd-5b81-8992-1a1688530b63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 6.1.10-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:f29b4ed5-95a1-5ff6-b376-ff65b31302dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 6.1.10-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:a889c11c-5a0e-5a8e-bd33-015a104d64a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.12 of @angular/language-service. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:81c1ce19-2276-58e8-9c1a-4cbd1183b35e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88058 affects version 6.1.10-tuxcare.12 of @angular/language-service, and is fixed in 6.1.10-tuxcare.13." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ], "bom-ref": "urn:uuid:e0d619d2-9076-51ab-96da-4f8f331a216e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 6.1.10-tuxcare.12 of @angular/language-service, and is fixed in 6.1.10-tuxcare.13." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.12" } ] }