{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2194e4fe-9210-5a96-8216-97a9c7ddc0d0", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18", "type": "library", "name": "@angular/upgrade", "version": "5.2.11-tuxcare.18", "purl": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:644db000-bcf5-55eb-86d2-32adc5b649bd", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:78d9774b-94a9-52b3-aad1-a30560b96e46", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:85ed1d90-6ae3-584a-a9fc-479dd43a01dc", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:d599b194-cf8c-53ed-825e-721cc9dc0b6f", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:398683d2-fc04-5ef0-a73c-9713ca4af951", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:71b42996-2833-505d-8fae-13f14fa70e71", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:ed268ca2-0dcb-5bca-b0b2-aaec822cf845", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:dd640a85-4fe1-591d-8398-0abd4cb72e85", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:bd36d6f2-bfa3-5ddd-a50f-6bb753c2d023", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:2f8f043b-b3db-5756-87cf-72fbfce615b6", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:dd20ca97-9b47-5d6a-a06d-e773dbaa9ca3", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:55e4daf1-b03e-5270-acf3-fac2ee9eabd0", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:d18842c9-9c9e-5170-97e6-d27cf508c241", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:e0a527f3-2ec5-5806-bd88-da312222cebe", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:8fc60270-bb07-507e-aaa4-98940626f6ab", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:f34f68c1-33cd-5263-b83c-d8214304fc1f", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:c667457a-b04c-527f-b247-df4691183a4b", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:5db93981-b5cc-5f01-8742-4e3cfeb21459", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:b4cb1cad-034f-5ea1-b2fe-8f99c4ddf5c1", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:01f1e66e-63a8-57ed-ac69-69860062da75", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:4e51617a-2fd8-5277-af42-3560de83d831", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:3f308526-ad2f-57fe-b38b-82be9cfa77d2", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.18 of @angular/upgrade. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:8e104d82-7f65-54b2-85f7-ab813a293a2c", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:c50428ac-0d46-5051-8f95-f84a09582bff", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:1e6e5ade-cb11-596c-b5cd-ef495a7bab6e", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.18 of @angular/upgrade. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:b355cc15-500a-55bf-b2e3-2f54d53ef839", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:db3723c0-d933-5da6-88d0-fcddb1840dea", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.18 of @angular/upgrade. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:d81aabe8-51a5-55a3-984a-ca53bb91dd5e", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.18 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@5.2.11-tuxcare.18" } ] }