{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:700dea3a-a596-54f8-8879-c9bf26a206c5", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16", "type": "library", "name": "@angular/upgrade", "version": "5.2.11-tuxcare.16", "purl": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a12c6aba-fa4e-573c-adcc-a6449b3c4fdf", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:1b7b8cd4-c316-57bd-abd3-7b355eb2c557", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:716a3e7a-69ab-5eac-8c0c-dc5355690e16", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:9d6af475-81a7-5ce3-b361-427b5526da37", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:2c7c08a1-f4d0-5126-a805-bd02ac795e80", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:f895f262-fb96-5472-afa2-681755d053af", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:cc4fa334-dc52-5a78-b1a2-f14c5b11106d", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:ba27e631-ffe3-5420-a6bd-cc98dee922b6", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:fc68b51a-7cbf-5240-8b1a-7a88eae2cfcc", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:521f5d76-d69e-53a3-8576-cf186f783587", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:73a66d33-7289-51d9-9a6c-cfaef1372f66", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:9d5c4e1f-0301-5804-a39d-c0be9330a393", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:73841f39-0ff7-5006-8d4c-d9493e788731", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:13f12ceb-81a4-5a8b-8394-9180925c3529", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:8c435833-9a2b-5132-8609-c053ec6cbd88", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:d8163c2b-5166-511c-8ddb-b4daadda8f76", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:ae28f351-a410-585a-8a41-998e74445bbe", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:f8cf494a-b51a-5c66-9b0f-962c3e2a557c", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:afe1d56f-dfa4-596c-8578-450b99013f60", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:05714077-8f30-5a7b-8412-200fb424ebcc", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:839dd337-4daf-5b8c-83ab-a252cc167359", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:e5d96540-14c5-5dbf-aebc-b4b1dc29c664", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.16 of @angular/upgrade. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:2c88e1a9-a4a2-5cd3-8450-3b67e7b13efc", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:3314ce3a-48f3-5d7a-abc6-c005f384a011", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:00100d84-b2af-59c9-9576-5d3473fd9ff6", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.16 of @angular/upgrade. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:cf7329b6-23ae-5cb4-bdd8-759da751cdb8", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:1be7a652-8404-5da3-a99f-90e8bd742ddd", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.16 of @angular/upgrade. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:95e4361e-3612-598e-91a7-f83a77da6eb4", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.16 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.16" } ] }