{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:98faf778-ab51-55d3-beab-d6b65ebdf20b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17", "version": "18.2.14-tuxcare.17", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:2b70d546-c01c-5be9-9666-3b64e504ba7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:fc730214-21af-5875-8a8f-edabecc6f9c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:d93686fe-1c83-5357-b35a-7347166acbd8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:fb281d21-9298-5f11-98cc-32f08c9d39a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:a040c1f9-5c3e-5de7-8682-5e39d1279333", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:ded37d19-ec83-5e1a-a884-57f154a37177", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:40939cbc-d213-5e71-9df5-ca1a44ea88e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:b12c84da-600d-5e71-9aae-66fcdc40a558", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:2e8d75f5-d45d-544c-9745-292639bae853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:2dddd70d-feca-581f-9af9-2b549dc3cb7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:10d0afc0-ff09-55fd-84a5-09181d64c7fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:3b26c736-ff78-515f-9353-2e7e0724d482", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:c6e8d395-f1e1-5aa3-9340-768596a8873a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:94cb92ca-dd7b-5469-8643-055405037f3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:b30dee9c-66a6-5902-a6ac-a535c53f330e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:862ffec4-096d-509d-9105-095d79130803", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:62f1fdd8-0fd8-508e-8d2e-808972f88d7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:10917b27-3db6-5bed-aff1-0c5589afcef0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:6493ff72-5d47-55fa-a199-87c85c5652fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:e406aa42-d6ab-5446-8467-6f33fff1ba2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:0699a162-4ca1-598d-9242-6abce26ac06f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:74dfa892-f164-588b-ab90-02ba9e02b012", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:ec1b7543-24ec-5722-84eb-b3d186f5b7be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:084219e3-545b-5e17-bdb6-092e7dd4a18e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:5c8e1841-b04b-538e-bbb3-a3a19a8e37a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:5d5d610c-f0d1-5e2b-b3a8-aa857f676ee6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.2.14-tuxcare.17 of @angular/upgrade. not_affected \u2014 The target version 18.2.14-tuxcare.13 is NOT affected by CVE-2026-88056. The vulnerable code pattern (calling String.prototype.trim() on URL strings before resolution) was never present in this version. The target uses a refactored parseUrl() implementation introduced via commit 49a60f6045 (May 2026) that correctly handles Unicode whitespace by percent-encoding it rather than stripping it, main...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:d2369899-d72d-5b4a-aa3f-8709d9af2e4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:670f8c89-0371-5b43-8847-06f15eb07180", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:00033c31-8e18-5fde-9e78-4c712b59a0f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ], "bom-ref": "urn:uuid:445607ba-9392-58f4-9c4f-87b4e3696828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.2.14-tuxcare.17 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.17" } ] }