{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f41c9ec7-7865-5350-baf3-4491a7d4146d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16", "version": "6.1.10-tuxcare.16", "pedigree": { "ancestors": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@6.1.10", "type": "library", "version": "6.1.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:f10092b6-512a-5f89-8325-8a968e89808f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:24c89631-210f-5c90-8517-5f388235f728", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:18b0716d-cc42-5ebe-9e60-54f7d74d29f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:f1de947e-08cb-5a67-86a1-c43e9420b5a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:ea705ee6-f502-5db3-8b75-ddc7c24534d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:a2a4554c-3315-5edc-92e9-23306eaaf88e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:0a09bb54-adbd-574b-8fe1-01a2124cc9a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:e9ee80b5-fa48-5ca2-bce7-3832ab2f9150", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:9ac348b9-9d17-5274-b581-9165125dc75f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:7d1ffffd-3387-51e6-8c9a-33d71f27bbb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:f47db181-0345-5ed9-b70e-747149264afd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:405843a2-000f-5290-931f-e228f3d6f456", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:41c2f161-c28e-5471-aa40-0564cb3c9f97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:dbf72c74-af31-5d86-a8a5-5bc7056d1266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:fdd02bb4-e438-589d-aefe-a112b36bed07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:56026c5b-cbcc-5dbc-804e-459eac9034dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:f3b6f2aa-e93f-5664-8628-01e800b945cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:c56ba5a8-6b59-5d4c-82a4-5214246ae491", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:168b86d6-9b33-55e8-8ac4-47a948295182", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:3f503eb5-139d-5585-a255-d50e28ae5496", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:4496b529-d1f4-5899-b01d-adeb5024c0f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:2f34b6c0-23e1-5442-b14b-ae3153bd8424", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:151ed5d4-768e-5131-a0de-393bed4048bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:8f3acfbc-2aab-59c9-96c0-87eca1e2f744", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 6.1.10-tuxcare.16 of @angular/benchpress. not_affected \u2014 Angular 6.1.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version \u2014 it was introduced in Angular 16.0.0 (April 2023), more than 5 years after Angular 6.1.10 (2018). The vulnerable file `packages/common/http/src/transfer_cache.ts` and all related APIs (`provideClientHydration`, `withNoHttpTransferCache`, `sortAndConcatParams`) are completel...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:24e704af-2298-5522-b766-13ca3c533a25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:fe380d36-d5d0-585f-aa95-ad3659af67da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:794dd305-c0cb-5622-8118-73c4cb69a227", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.16 of @angular/benchpress. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:06165e2d-3acc-586c-8903-7d575f9e5263", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:2c859870-1a90-59eb-9da6-41598b1f70f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:dc1e7604-f72f-5079-966a-89e6c8224f20", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 6.1.10-tuxcare.16 of @angular/benchpress. not_affected \u2014 Angular 6.1.10 is not affected by CVE-2026-88059. The vulnerable HttpTransferCache feature, withRequestsMadeViaParent() delegation API, and modern hydration system (provideClientHydration()) do not exist in this version. These components were introduced in Angular 16+ (circa 2023), while the target version is from Angular 6 (2018). The vulnerability requires automatic HTTP response caching duri...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:6cd400de-7780-522e-8413-68681508806b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 6.1.10-tuxcare.16 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@6.1.10-tuxcare.16" } ] }