{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f1006474-876f-5c5a-90ff-f325ec0f6f19", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22", "version": "5.2.11-tuxcare.22", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:88bef9f5-cd24-5afa-aa45-52966b2551ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:fc693011-1483-5032-8ba1-25c037e97878", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:954f6d50-1917-5399-86d5-c7e4dbab90d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:c6ad1880-20e4-54d6-99fd-46d8e6a3ab3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:3f8f380e-a699-5d52-bbab-867120a0d3b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:1edb4f7b-cb54-5592-976d-ea985e4d00fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:bbe91624-1599-5d5f-8281-1d6005e7659e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:393cf46a-9458-52fb-86ed-6eea93cd7eef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:235f49c0-7738-50fb-9b15-51ac9f6ef7cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:837fefa1-d431-5c3f-800a-d3062c2f5981", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:cb02ec2f-1829-550e-9889-8b70a0f734e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:2104cd80-d1b3-5224-87d9-59781ebd05b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:0690468f-ba59-5da0-9470-fb0d259f61da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:24e7482c-a64d-523c-bce7-825767fc68f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:dab6d8e5-7b62-5b73-8ece-31e17f5eec53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:208d649b-f6f6-55f5-b76c-4fe4d362a901", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:eb4b7d92-7660-55bd-8c9c-17c995229441", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:3fe2c355-787a-56eb-be28-03ed222696e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:5a334ced-9479-58cf-ad6a-90945e46e81b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:c992d97a-7957-51b0-a159-43d7fe7a2a8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:cc080e30-0c6d-5d88-95a1-ae8c944c04a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:c156ac0c-8bd7-5167-8598-2e2ba1d42526", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:bd672925-6d5c-5a6d-aceb-5fd0b56c87b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.22 of @angular/benchpress. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:c5b28863-e65f-5476-8aa8-358e85cc66ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:a92d88eb-e900-510a-9608-30a65dc51b30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:8f553da1-f144-501b-9eb5-faf0e75663af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.22 of @angular/benchpress. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:cda53efe-1c27-5440-a43b-2a7f0cb4cbb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:6630c52c-de1e-503e-98e0-775211b29c4a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 5.2.11-tuxcare.22 of @angular/benchpress. not_affected \u2014 CVE-2026-88058 affects the domino library's HTML serialization (XSS via ancestor fallback raw-content tag injection in comments/processing instructions during SSR). The target Angular 5.2.11-tuxcare.19 repository declares domino 2.1.2 as a dependency but does NOT vendor its source code. The vulnerable code (NodeUtils.js serializeOne() function) lives in the domino npm package, not in Angular's ...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:dec0b866-8a9a-53c5-bc3a-7867dea54da7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.22 of @angular/benchpress. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:91d86af8-1d31-52d1-a39d-c0d0cc91f8c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.2.11-tuxcare.22 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.22" } ] }