{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8ab4cdbe-8b65-51cb-b5e8-90330bafd25b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1", "type": "library", "name": "@angular/benchpress", "version": "5.1.2-tuxcare.1", "purl": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:860310e1-3028-597b-8935-7da79671867e", "id": "CVE-2021-4231", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-4231 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c4b98415-8751-5eab-ac69-2f9be1e7adb9", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:abb0866b-67f6-5ec6-aede-56d26a227269", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:69664f88-571e-5a6b-871f-88fcfd1b2ba1", "id": "CVE-2026-22610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1e7963b9-7577-5a80-992b-912d83d1b298", "id": "CVE-2026-27970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:44385d12-da72-57b8-b6f5-b7013054f1d2", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.1.2-tuxcare.1 of @angular/benchpress. not_affected \u2014 Angular version 5.1.2 is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API which exhibits hostname override behavior with protocol-relative URLs. The target uses Node.js's legacy url.parse() API which does not have this behavior." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c487a40b-1013-54b7-b92d-8e68c90bc548", "id": "CVE-2026-46417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:19e3a3aa-48a4-5cc6-a6c0-459d84fe49ab", "id": "CVE-2026-50168", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:19e59f13-ae00-5659-b554-5a8f6b3dfb91", "id": "CVE-2026-50169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:07705f29-8d1b-53dc-983b-01563a19b7e0", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 5.1.2-tuxcare.1 of @angular/benchpress. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e6c4f33e-9e3b-581c-8e85-839b632a7a23", "id": "CVE-2026-50171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7a173825-d7e1-5ec7-a45f-699fbb912dff", "id": "CVE-2026-50184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b9b63759-3080-5ffa-a816-74092dd26495", "id": "CVE-2026-50555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f9421904-167c-5667-a742-3c5153618a93", "id": "CVE-2026-50556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:163be954-dc5b-5412-9007-8d29c1cd2439", "id": "CVE-2026-50557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2e3d6391-68ed-5e8e-9d07-9e77debd1510", "id": "CVE-2026-52725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:41d3838d-5efb-5ff3-a796-d43a4068fbb5", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 5.1.2-tuxcare.1 of @angular/benchpress. not_affected \u2014 Angular v5.1.2-tuxcare.1 is NOT affected by CVE-2026-54264. The vulnerability requires a `newRequestWithMetadata` function that copies request headers, which does not exist in this version. The service worker reconstructs asset requests from URLs only using bare `adapter.newRequest(url)` calls, never copying or forwarding request headers. Therefore, credential headers cannot be leaked on cross-..." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0c1cffb0-a62f-591e-916f-5c07077aa00a", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 5.1.2-tuxcare.1 of @angular/benchpress. not_affected \u2014 Angular 5.1.2 uses the View Engine compiler architecture, which does not have the TwoWayProperty operation kind that is vulnerable in the Ivy compiler. In View Engine, two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings, ensuring both receive identical security context resolution and sanitization. The vulnerability pattern described in CVE-2026-54265 c..." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0c255a2c-c3db-5eb4-bc5b-758039404abf", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 5.1.2-tuxcare.1 of @angular/benchpress. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature that generates cache keys using a weak 32-bit DJB2 hash does not exist in this version. This feature was introduced in Angular v16+, while the target is v5.1.2. Although TransferState exists in this version for basic state transfer, there is no integration with HttpClient for automatic response caching, no..." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6f681d26-44ec-5a69-9424-e29d2458b5a2", "id": "CVE-2026-54267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:14db798b-31c3-525a-87b1-60f856f9d74e", "id": "CVE-2026-54268", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 5.1.2-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@5.1.2-tuxcare.1" } ] }