{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:39430853-7e1a-59da-ac85-794d58fa50cf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7", "version": "7.2.0-tuxcare.7", "pedigree": { "ancestors": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@7.2.0", "type": "library", "version": "7.2.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:36572658-02dd-5015-9187-7f18880f48d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ce2e9087-763b-5922-a280-3bd5d25fa500", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:325c1ce8-1681-5822-b806-622925312fa2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:b3e0280a-53fe-5e45-b74b-a154cb4cde72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:13632266-c4ce-56b3-b6d2-4a89f3635969", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:f8310d11-8791-5e7b-8d2a-623e1623d02d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:086505eb-5eb1-546c-a5ca-893ce0f749d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:481d4542-1954-5b33-bd9d-114d76811f50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:d58d29de-76ae-5c0a-8efc-2b691ee0f603", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:bb7b3f3a-353b-5999-b2a4-bfe67ae56933", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:5993d3c9-a177-5841-9a76-8fec36c0d7fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:fb444737-5db9-5e02-801b-b23a47c5ce23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:f0ab81e2-72a7-5483-a8b8-8e04bdaf44b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:1206469d-7972-599d-b551-19c5f298fecd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:b1b4790e-0517-50ae-a887-630430d319cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:c3a6d74c-e76e-539d-9b42-5c3d16de8acc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:658b10a6-6e18-50ac-9c99-bb834523e084", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:d7e73605-27a3-512d-aa89-d4b6e7ed1301", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:b3394d81-3348-5ba7-8cf3-60dd604c3991", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:b8a22a25-b9ef-5f8f-8540-446704139ff6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:03cf076f-5652-544a-b65c-4f265d4f8050", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:b6731b14-a0eb-5fa6-a96d-78df076f7481", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:4c9471f5-ff25-5052-a416-08ad856f6521", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:e9d0f04d-e710-5cfd-bf84-92e65807dd8a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.0-tuxcare.7 of @angular/benchpress. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable component (HttpTransferCache) does not exist in this version. According to patch documentation in the repository (CVE-2026-50170.patch, CVE-2026-54266.patch), the HTTP transfer-cache and client hydration features were introduced in Angular v16. Angular v7.2.0 predates this feature by many major versions. Exhaustive searches confir...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:a29aed6d-6e6b-594e-9592-b746924ab157", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:2497bb9d-bb12-597f-b106-cda73fc91b1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:0bb524ba-ab69-5e77-be7b-6e48b72e4dc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.0-tuxcare.7 of @angular/benchpress. not_affected \u2014 Angular version 7.2.0 is not affected by CVE-2026-88056. The vulnerability requires the presence of a `parseUrl` function in `packages/platform-server/src/url.ts` that uses `String.prototype.trim()` to normalize URLs, which strips Unicode whitespace and can convert validated same-origin relative URLs into cross-origin protocol-relative URLs. Version 7.2.0 does not contain the `url.ts` file; it ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:d14f174c-b980-530d-9e2c-dbe972bfaf19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:1d0dd0f2-6ad6-5532-97ad-4779385718f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:5f681b95-e65f-53e3-a1be-fefd5aabba98", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.0-tuxcare.7 of @angular/benchpress. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, hierarchical HttpClient delegation (withRequestsMadeViaParent()), and automatic HTTP response caching features that were introduced in Angular v16+. Version 7.2.0 uses NgModule-based configuration (HttpClientModule) with manual TransferState only\u2014no automatic HTTP-to-TransferState caching exists. The...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:82fc2967-e1ff-5e57-8a7a-83539cdcc030", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.0-tuxcare.7 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.0-tuxcare.7" } ] }