{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6c8246e4-9f49-5417-bfd0-27064498d193", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14", "type": "library", "name": "@angular/upgrade", "version": "5.2.11-tuxcare.14", "purl": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:85a025d1-1f4e-5579-8b70-db3d6c1dafc4", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:88f822d0-b066-5ae2-8791-8b8d419cd003", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:10ab019d-b572-58ef-8e51-5d89fd689d98", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:4181edec-8b5c-5015-99a4-0ea0f7ffb387", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:9d56fd01-41ea-518a-94ba-d23db3728536", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:0dab4fbd-2e14-5d24-a8d1-108cddeafecc", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:b7f2fd86-e990-5b0b-8f51-fbebe71d9582", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:084dd503-b67c-58f8-a0f2-cc3616f80ace", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:05d6939e-a994-52ec-a86e-4d46d91efde7", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:78ea98af-b089-56f9-b84b-807e34ff69c0", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:6bea6cdf-5c19-5c80-bd4f-d84e25e9ec06", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:f96ab791-3f58-5bd9-bfff-ebee8d5aa288", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:23498173-2523-5e82-bfc8-5d3ab5c6b07d", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:4e85e47a-200e-5990-9025-122ad10491b4", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:666832c5-2b83-5ba4-a50a-d52f946f3794", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:eed206f3-4445-5aa5-8f47-76abf32cee3a", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:fe0fbee1-0647-57f0-83b1-2979dc19962b", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:0934be48-8bc4-545d-a9a9-752d8f0bcacc", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:b0b3a1d2-0c1c-5566-b381-108536c3f570", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:4f4a4ae2-3f15-5b70-88bf-637f77da7e89", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:f64c6d86-de2b-56eb-b705-5f3ca44f3de1", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:c40f7f66-83d4-5e6c-abea-d467b6aac9f9", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.14 of @angular/upgrade. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:a606c770-22b7-51ab-bc53-a7f032089ed7", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:d446c061-34eb-5f80-8bdf-473093626ea9", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:7e0e46b0-29db-5810-aecb-58cab8e28a28", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.14 of @angular/upgrade. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:cf472b16-3923-5026-bdfa-d9e7dfd63ffc", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:09ae0010-c521-5437-9453-ce50a18d87e5", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.14 of @angular/upgrade. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:9168c492-6a26-5b46-8509-97c78f6effdd", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.14 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.14" } ] }