{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:96530e33-c022-5c77-aced-87352552f3a2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15", "version": "7.2.16-tuxcare.15", "pedigree": { "ancestors": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@7.2.16", "type": "library", "version": "7.2.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:752c5df0-d8e9-52c6-8a6e-bdf9e6919d80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:c5ff1f8d-39cf-5025-bd13-27715eb5a1a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:d1056605-9d02-50f1-bfd2-8de5d5e77211", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:a6f71846-3acc-5eec-9e82-2e0ebc2cdf84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:b0dac8a2-f723-5406-b3a9-ebba489a1b1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:87b6f960-6e9c-5ef0-b5cf-d640757a9abc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:d524a0d0-9f8d-5236-9034-7d587033c69c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:64d79d05-f31d-5d7d-86da-f87584a8a916", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:e8192537-84a0-506e-84a3-d1890ee2f330", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:2bd4b64c-e446-5632-bc91-29b385a2b906", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:16a5f1b4-f099-5d28-9e1a-f4b3ebb29968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:76ad8889-ff86-55af-b1da-185ca6f6cd97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:f04bb153-9925-5e87-8b91-ba69eed83234", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:1aa31420-ffa1-5342-8d59-795364aa938e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:6ab32c04-ea2c-5604-b859-15be9f3715d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:1bbbc0f5-5009-5355-8ff9-c94cab2a8ec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:3700aca0-7422-582b-9b61-aa2ed039d380", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:78525ad7-0102-5c0e-ba49-a7c5c77719d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:75decae5-e858-5211-8e85-c421a4c5efff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:6c772496-34ff-5362-9841-8b05ae052125", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:16212d23-cead-5261-b82d-f3a85d72f994", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:7a7b0bb2-3479-5efd-b7f6-08a790e2451e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:cbfaaa65-0513-5cec-b8be-384ad036513c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:85af37ce-83fe-5890-a90c-634934402272", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.16-tuxcare.15 of @angular/benchpress. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-68945. The vulnerability concerns HttpTransferCache's cache key generation logic that treats repeated HTTP parameters (`?role=user&role=admin`) and comma-separated values (`?role=user,admin`) as identical, causing cache key collisions. However, the HttpTransferCache feature does not exist in version 7.2.16\u2014it was introduced in Angular v16. While v7.2.1...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:28aff133-207b-53c0-a52a-5249664a6b42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:6b765145-7f14-5cb4-95b6-a802bdf78e5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:d96eff48-14e1-5314-b4ba-9a42fc90d868", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.16-tuxcare.15 of @angular/benchpress. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88056. The vulnerability requires a String.prototype.trim() call on URLs during server-side rendering that strips Unicode whitespace characters, converting same-origin relative URLs into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 7.2.16. The CVE describes a vulnerability introduced in later Angular versi...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:274c05bf-fadb-59a4-87e1-27d701ec2140", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88057 does not affect version 7.2.16-tuxcare.15 of @angular/benchpress. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88057. The vulnerability exists in the Ivy compiler's template pipeline (introduced in Angular 9+), which does not exist in this version. Angular 7.2.16 uses View Engine, where the SecurityContext determination for directive host bindings correctly uses the concrete host element name (`element.name`) rather than the directive's selector. The exploitati...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:a2b05344-264e-5225-957f-d15da4ff99d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:a4f7c2d5-cc5c-5728-a19c-07aa7211919d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.16-tuxcare.15 of @angular/benchpress. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and client hydration features that were introduced in Angular v16+. Angular 7.2.16 predates these features by approximately 7 major versions. The codebase contains only legacy TransferState (manual key-value store) and NgModule-based HttpClient (no hierarchical delegation...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ], "bom-ref": "urn:uuid:844f1275-4a2c-5b71-b633-fbb8afba006c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.16-tuxcare.15 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@7.2.16-tuxcare.15" } ] }