{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:55bc895e-49b4-57c9-b057-65a439ed150b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17", "type": "library", "name": "@angular/upgrade", "version": "5.2.11-tuxcare.17", "purl": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:cc66f60f-f535-5650-bfec-dd16f29731a9", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:b64eb44c-0baf-51dd-a3d7-c103c227ddc6", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:efa844d4-d128-5477-8cd2-e5bf92e396f5", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:2b13b84f-03c8-50c2-a1dd-eff0919e6d1d", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:ff9c6b7d-22a3-5213-a82e-3e08d63e35a2", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:0462b236-af0f-59f8-9a9a-9c4484958a62", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:e7fcbf7e-8732-562b-beef-7a169e9a154d", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:61a395a5-545d-549a-88d8-fcdf9cef467d", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:7cadae17-a5db-5928-9e2f-9b972835b842", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:dfca9cb1-bf2f-5280-9931-de7fee2cc1f4", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:6a782354-ff44-5c8b-89ce-2caa5a441e85", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:eab32b4b-e8ab-5aff-a24b-075c868a6549", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:3b13c0cf-3af4-5b00-8a5e-aa10cb8b5231", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:f2df273d-b89a-50ca-8188-dbd86d826cb0", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:463e811c-e0c4-58dd-965a-cd25fbbc2106", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:489d6a3b-c5e6-5c69-a788-a1a7059e2447", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:67bc21a4-f2ae-580c-8c5e-60c5c6fa1984", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:88fb1db2-82a4-5f72-b135-d2049397d54d", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:5e17d9a0-438d-59dd-8e80-f6b09c882a80", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:f960f866-2201-50ae-8196-80332fb7f012", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:11e7d8a1-e765-5579-a73b-f4d4f8ff54de", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:0479d2a0-13d2-5e30-9556-483bcb6c060d", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.17 of @angular/upgrade. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:e70ff604-45b9-57d9-9a47-33fc5d48001a", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:724254a1-ac52-5f97-8d04-308d3f648f57", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:27b4b7cb-451a-526a-a83c-6cbdc57adc2f", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.17 of @angular/upgrade. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:57e74d92-9c8e-56c2-9a3f-85153b0abde5", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:08bbce61-b3d2-531d-bdfa-8ff378c8c595", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.17 of @angular/upgrade. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:525a63df-e143-56b2-85a0-ec778ecd27e6", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.17 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.17" } ] }