{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bfb80bff-40cb-584d-a288-df7984d53cc4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14", "version": "6.1.10-tuxcare.14", "pedigree": { "ancestors": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@6.1.10", "type": "library", "version": "6.1.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:4b49cfd3-1f02-5cd7-a7e9-1462dae2e002", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 6.1.10-tuxcare.14 of @angular/language-service, and is fixed in 6.1.10-tuxcare.15." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:82afd03c-99ce-5a87-865e-0387065caf42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 6.1.10-tuxcare.14 of @angular/language-service." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:fed6bf19-3ffc-5306-865d-56e5ccd4386d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 6.1.10-tuxcare.14 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:58d1efc0-46ee-5dbb-9d7d-a589956ab822", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 6.1.10-tuxcare.14 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:9c4edb05-1edb-5005-830e-832c25bb5f8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 6.1.10-tuxcare.14 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:0eff47e7-29e5-55d3-930c-077e901a23c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 6.1.10-tuxcare.14 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:23e68114-1784-5fa1-9f1d-51a9021263fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 6.1.10-tuxcare.14 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:455d7d1e-ab12-510e-9c13-44ad8b162652", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 6.1.10-tuxcare.14 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:790b97ca-e7c7-5ac5-aade-4f7f87e581a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 6.1.10-tuxcare.14 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:f20ccaf6-b6b1-5ac2-a6da-0f692400c3d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 6.1.10-tuxcare.14 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:c11c8588-ceaa-5593-8398-e64958c7da34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 6.1.10-tuxcare.14 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:eb45d62e-5f92-51cf-93d1-d019fa901345", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.14 of @angular/language-service. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:348b3d64-4824-50e8-971b-96ff473ba412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 6.1.10-tuxcare.14 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ], "bom-ref": "urn:uuid:ff6a3d17-0279-5c9b-842a-9ae33dad40d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 6.1.10-tuxcare.14 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.14" } ] }