{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7ae8bf04-8678-5542-aa71-6df35e9074df", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14", "version": "12.2.17-tuxcare.14", "pedigree": { "ancestors": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@12.2.17", "type": "library", "version": "12.2.17" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:3f075a7b-ebb6-5de1-b1ef-d80fafec2493", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:d5f0a58d-4732-5898-aae8-fcb6f134e76b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:e6a39853-d190-585e-b75c-eaddfa1c14b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:327cc5bc-cc73-5c8c-9c11-f16fb34cd936", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:f3bda63d-27ea-5e9c-b323-98d8630f61f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:349687fb-d6de-5330-bf65-73274070f230", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:f3e9bca7-71f2-547b-b4d4-34d90016d0e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:4019a921-0d3e-5e01-8775-cb7b5524208f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:363b9b30-ce10-5715-8c4f-8064126ad339", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:5e0ebae2-9219-59c1-ae0b-509b931b0e7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:a653f236-bf79-5c3b-976f-619fbf30eb06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:275792c5-4c3e-5797-9fce-4b3c5e0ff911", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:6e87b165-fed8-5c45-bb01-2f36e68c9ada", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:6ab13009-0dc4-57fe-a910-334d1d44dd4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:d82d3dc0-6902-5677-832e-b578fe42c149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:d5c457ca-7176-522b-aee7-05344e556f13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:f8021c78-9c41-56b5-9cfe-d65f002641b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:cef17824-e811-59b2-a56f-cf36cd1beb2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:c221c182-6085-56da-9b7e-cab7e8dac2c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:989af14f-1b45-5ec4-9a4a-c77f2e3a7158", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:8650c560-d039-592f-8395-83dfde69abf3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:b4e6234a-9436-5964-a508-bdeedaa59ce0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:dfa594f7-69ad-52ae-95c9-1fc387d9a007", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 12.2.17-tuxcare.14 of @angular/benchpress. not_affected \u2014 Angular 12.2.17 does not contain the HttpTransferCache feature affected by CVE-2026-68945. HttpTransferCache, which caches HTTP requests during Server-Side Rendering (SSR), was first introduced in Angular 16.0.0\u2014approximately 4 major versions after the target version. The vulnerability concerns cache-key collision when repeated HTTP parameters are serialized, but since the entire HttpTransferCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:c1c490b2-95fa-53f1-96ef-903a17d8a2ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:c981756d-4ab3-5c6f-8d35-b2e75e548880", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:5c28d6e1-e168-559e-b053-0b2b5886a0a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88056 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:ec057965-cccc-57cc-900d-6d2d2ea5a061", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:b3c088ef-1893-56c0-8b54-294ec5873e93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:30e94755-5b35-5e4e-b7b5-147de070c46c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 12.2.17-tuxcare.14 of @angular/benchpress. not_affected \u2014 Angular 12.2.17-tuxcare.9 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and provideClientHydration() features which were introduced in Angular 16.0.0. This version uses the older module-based HttpClientModule system and lacks the entire SSR hydration transfer-cache infrastructure. The vulnerable code pattern described in the CVE do...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ], "bom-ref": "urn:uuid:b6a0b7a8-ede4-5bef-848c-770528a7e49c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 12.2.17-tuxcare.14 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@12.2.17-tuxcare.14" } ] }