{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:655e161b-9b69-5d46-b3b1-097f75833480", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/http", "purl": "pkg:npm/%40angular/http@6.1.10-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16", "version": "6.1.10-tuxcare.16", "pedigree": { "ancestors": [ { "name": "@angular/http", "purl": "pkg:npm/%40angular/http@6.1.10", "type": "library", "version": "6.1.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:e8e08050-26b8-5645-b21c-d66df36605e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:a04a13a7-5672-5eab-bce2-898560d2d8ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:d57f65ac-c0a1-548f-99de-466bd163bfa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:5e7ea3c1-4c78-54a8-b072-9378aa014c9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:c27de6c4-f2d0-5043-a26a-5baca5dec5f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:322aae8d-a559-5ddc-a76b-ffabf84cd242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:2bf6ff35-99fc-5293-a576-9e50b940bd73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:fcc05ca7-58a2-5021-aae1-d042847479d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:4108c25c-a1cc-5036-ad56-5cfd405471f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:cadbd029-eaf2-5ba4-8cdc-d6336392d95f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:67ad6435-2c9e-5f5b-a39b-bc4f288f146e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:086003e8-770e-5a89-8aa5-07e433959a7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:8ed6674c-7b4c-53c2-82ba-180784dfc1cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:454e1f37-45c5-5f15-9f19-426c4ceebbe5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:7eb4ef20-3896-5799-b023-77d78caebd33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:ad18fb0b-ba97-51d3-ac90-e3aebcccdbaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:dfa3df7c-fb07-567d-a6ea-65783443549d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:8936aac2-b026-520a-974a-d8f479c97ef8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:8e86728e-7032-5d4b-bc31-2506b199c802", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:75c96edb-fd33-574a-a554-745990c650f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:32ccbc87-42f7-5f14-962d-476f3eb439f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:b8054660-6c48-560d-955b-ff9ccccca92c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:4f1f0a43-7e64-505c-8ae2-c03860adf32a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:12d03b3a-3027-516f-b29a-d6271982cf9c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 6.1.10-tuxcare.16 of @angular/http. not_affected \u2014 Angular 6.1.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version \u2014 it was introduced in Angular 16.0.0 (April 2023), more than 5 years after Angular 6.1.10 (2018). The vulnerable file `packages/common/http/src/transfer_cache.ts` and all related APIs (`provideClientHydration`, `withNoHttpTransferCache`, `sortAndConcatParams`) are completel...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:f249ebcb-4360-54f9-addd-b1c963d1e95b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:bfbd99bb-0361-5890-9ad1-586691927337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:fcba1b7b-4cea-5e1d-90ea-ecb9032cca36", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.16 of @angular/http. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:101bd4e0-bccd-594a-a0b2-169995701f2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:06cdab26-92f1-55d5-9c26-f898a9b5747b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:5540ba6f-59e3-51d4-b0de-08da6d7cfcea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 6.1.10-tuxcare.16 of @angular/http. not_affected \u2014 Angular 6.1.10 is not affected by CVE-2026-88059. The vulnerable HttpTransferCache feature, withRequestsMadeViaParent() delegation API, and modern hydration system (provideClientHydration()) do not exist in this version. These components were introduced in Angular 16+ (circa 2023), while the target version is from Angular 6 (2018). The vulnerability requires automatic HTTP response caching duri...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ], "bom-ref": "urn:uuid:5d27718b-1e0b-5f14-b239-e9e4ead720f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 6.1.10-tuxcare.16 of @angular/http." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/http@6.1.10-tuxcare.16" } ] }