{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2622764e-529d-53d6-ae8b-f1d17ebe1d31", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16", "version": "18.2.14-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:67ae6df2-9f3e-584c-8399-7b21c6063f77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:c5abe236-726b-583b-b3c6-6b18536f04d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:48bab946-73d4-5b0d-ad4f-04122e5ac6ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 18.2.14-tuxcare.16 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.17." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:56f32eec-7f19-57b3-acd1-d753c5387906", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:3226ac95-8a07-5fc1-8d57-6387191bfd49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:174934d2-b06c-5ef4-af22-4e43a0ebf7d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:5e0f640f-ff11-564d-9877-0ffc4b7adc30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:5c888aca-fb9a-5704-87bc-c96a044f9f4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:2e6d4dfe-6f21-5fe0-8175-93c30b81c048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:abebd296-fd20-57e4-9871-0c3aede11a44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:393b6ad7-3926-50cc-94eb-330802e861c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:9541dbd8-6a4e-54c2-8891-6a3e8063cf24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:94e9c4ca-c190-5df2-a19a-04bbd4bc6df6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:4c389602-2f12-53d5-92fc-e142704e06d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:1e8bd41e-0d7e-5811-b455-2f6b06addf4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:c3cb6339-78ec-5fb6-b96b-f4739277b910", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:62142320-5758-5735-b66e-8d9448182111", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:00e500b2-3400-5966-8cc2-d695baba780c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:a5b2f94a-bbe0-56b5-8e33-3bf9216294f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:79335f37-6543-5ca1-a5a4-928be19c907a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:128ac7dc-685d-593a-9a07-7fa1f63bf4ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:09663d34-1507-55a8-86ea-e36485bdbd61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:c8f744ad-c0c8-56c7-bfee-9c9fb3720433", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:f2ef84bf-aaac-5f22-82a5-752806128051", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:b839c52f-daf2-5ea1-9b52-1e7f7b2eedc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:46f23490-efd7-5824-ab9c-1ff544f024ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.2.14-tuxcare.16 of @angular/upgrade. not_affected \u2014 The target version 18.2.14-tuxcare.13 is NOT affected by CVE-2026-88056. The vulnerable code pattern (calling String.prototype.trim() on URL strings before resolution) was never present in this version. The target uses a refactored parseUrl() implementation introduced via commit 49a60f6045 (May 2026) that correctly handles Unicode whitespace by percent-encoding it rather than stripping it, main...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:06e8d11d-2c06-5c9b-b678-14a149b9ea89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:326bdfb7-eec4-52b0-aecd-d899e0c53ff7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:f76c5717-20f0-57ee-b108-67b69e8d53dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:5d598693-7f18-5e85-8f47-b31cb6879ea2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.2.14-tuxcare.16 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.16" } ] }