{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8e1f9d5d-08da-5b0b-a92b-f3c0645a3599", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13", "version": "7.2.16-tuxcare.13", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:7d865ad8-3ed8-5e13-8a96-f125e8658a51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:964fbb8c-7e9f-5cb7-9676-8c46bc014011", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:f6b5c5e3-8ee4-5d50-9835-cb84def1ea84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:6cce16bc-36e1-590e-ba84-21045e9234ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:7524ee9e-a7d6-5fce-826c-55030ac1f6b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:00adfb8f-bbe6-595c-bbea-dfd8288a6ac7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:88622b42-9038-5807-af5a-52948d2692ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:ebb03609-3d2b-547b-bd14-d6ceed031702", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:d4ef2127-1201-5b93-9aa6-550fe638bdf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:d41714c9-4e44-5ea2-a000-72d16e5a94d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:5debb72b-a4b5-5ce9-b13f-18a4f88100c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:1c50cdad-a21e-57f5-85a3-21d1c8d8db7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:7808126e-1ec2-5610-9509-4a3dd003876e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:e5e48ae0-298d-5c5b-8e0b-2786a686c314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:0dc7f7c4-36f7-5718-913f-d6e3e026aaff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:82ff6308-5b0f-5b99-86d8-da5e0b2605fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:f3d8cb90-a0bf-5d11-9c6d-36c8e0a7786c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:b1326332-c297-5471-9da2-12d00855f6c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:a5fccc53-1086-5840-8a93-aea0fb590403", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:72df86aa-ad08-58a8-b891-870640ea673b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:46695da6-5956-557f-b36a-395e7e9a4e68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:3b5f2dec-e17f-506f-a51d-b5abfe4eccb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:bf7cc026-35bd-5d4c-9ff9-7ebdb70185d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.16-tuxcare.13 of @angular/benchpress. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-68945. The vulnerability concerns HttpTransferCache's cache key generation logic that treats repeated HTTP parameters (`?role=user&role=admin`) and comma-separated values (`?role=user,admin`) as identical, causing cache key collisions. However, the HttpTransferCache feature does not exist in version 7.2.16\u2014it was introduced in Angular v16. While v7.2.1...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:f94aa06d-4c3c-5e76-a613-545d79d5a01c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:6432df48-687b-59db-9693-e4bcb1e592c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:797fb360-f4da-52ea-9069-dd8bcc1951ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.16-tuxcare.13 of @angular/benchpress. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88056. The vulnerability requires a String.prototype.trim() call on URLs during server-side rendering that strips Unicode whitespace characters, converting same-origin relative URLs into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 7.2.16. The CVE describes a vulnerability introduced in later Angular versi...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:5e861c22-84b3-5946-a085-c9f3640a94c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88057 does not affect version 7.2.16-tuxcare.13 of @angular/benchpress. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88057. The vulnerability exists in the Ivy compiler's template pipeline (introduced in Angular 9+), which does not exist in this version. Angular 7.2.16 uses View Engine, where the SecurityContext determination for directive host bindings correctly uses the concrete host element name (`element.name`) rather than the directive's selector. The exploitati...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:f8b8a24a-d6c8-5cd0-8055-1071ea6d9e38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:86a8183a-b4c4-5f23-a2bf-48b10d03b992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.16-tuxcare.13 of @angular/benchpress. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and client hydration features that were introduced in Angular v16+. Angular 7.2.16 predates these features by approximately 7 major versions. The codebase contains only legacy TransferState (manual key-value store) and NgModule-based HttpClient (no hierarchical delegation...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ], "bom-ref": "urn:uuid:66ca5251-8692-59f7-9f6f-31ecb82185e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.16-tuxcare.13 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.13" } ] }