{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:de2377c2-e0ec-561e-93d7-de876a9a44e5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5", "version": "16.2.11-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:1a089c2a-de5b-53dc-8b84-f857db3c4ef8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:3c205ca0-ae4b-569c-b095-b78903aa32ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c963e911-7a0f-5a72-a2ef-f3ae4fc8e6a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:1ad245af-407b-5c61-91c2-8a5c8dcdd5ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.5 of @angular/benchpress, and is fixed in 16.2.11-tuxcare.6." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7887ffc3-5678-5848-b56e-f685190432f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b83baa1f-e798-55be-84e7-3c0c3d0923ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9eb3f8bc-80db-5e48-8182-5b2557ae36aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:bfa4e87d-8d26-5548-a64e-5e12e7891bf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4626d774-cdda-5dbc-8c49-edb0c85fbd1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:6ba972f0-0e3b-5425-a9bb-070e22578ddd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b9902a63-33d1-5595-8162-15f2ef1a6acf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:e24792f1-8bbe-5320-ad6e-b0fea14eaa03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:3a0c7be6-d7a5-5753-bcda-f82f91c0085d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:2d661a2f-d2ce-567c-8209-e1a5ffebb757", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7796d5b4-8b5b-5fd2-b8a3-344c0ad2db00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a06bcb9c-a3f3-543a-9398-9a6db3346679", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:78ed203a-04a6-52e0-ba82-f672149462a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:cd04ee62-9d5b-5083-8ff2-68b7cf0bc28c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7fb5aa46-eed9-5c0f-82b2-c1ffef506d4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:14e75ef9-f06b-597f-8028-9ca02023090a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:e8660d42-7ba6-5622-a45c-b59e5f5d8eec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ce2b0a4c-2b2a-502d-8af9-18db4b9fb786", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7c458273-d4ac-544b-8b45-106f6aed990f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:77360b5a-a7c9-578b-8b36-cc46e7d60630", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:04d41566-176b-5ab8-a878-87c87d460428", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:fa021027-ad48-530f-92c8-10336a925919", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:872a33fa-1e9b-56a0-9f25-bb48179fc446", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.5 of @angular/benchpress. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5d28f239-e94c-5d68-a1a0-5b803d266233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:fddbc9b6-c373-5ed4-9716-f4498843d2b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c7c4e11e-5937-5a61-b6d2-7fdef030e462", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5dc64544-5d0d-50bb-a82e-c941e1e50aec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.5 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@16.2.11-tuxcare.5" } ] }