{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:54a80dee-48c2-55d3-85ab-403c30ac5db5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/http", "purl": "pkg:npm/%40angular/http@7.2.0-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7", "version": "7.2.0-tuxcare.7", "pedigree": { "ancestors": [ { "name": "@angular/http", "purl": "pkg:npm/%40angular/http@7.2.0", "type": "library", "version": "7.2.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:a4966a05-4b9a-5eca-86ca-be9ea557f4ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:4ac9f19d-f1a2-5e6f-8ff6-bc78e053074b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:20fd70ef-88c7-5fc5-ac7e-2a5d437da73c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:9cff463d-03e9-5863-bb4c-ffe9084a57d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:4c7d120a-954a-50df-a943-2f5b7862f7ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:0a65c874-a6d1-5e23-bb6b-735d843573ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:2a2fae97-ffb8-5dd0-a22c-3a909d23ac77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:a8207cac-89a4-5bc6-a886-e858c2656f5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:dfc4f480-821e-5bf2-ac8f-2e41c1654a3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ba52b2ee-626c-5197-b63e-7d199e62613b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:52e67c6a-a022-52a9-abcf-18b84aaabf71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:7a99537a-6be9-5053-b16c-1341f854e21e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:aeabc931-d3b5-586a-a59d-e57757ffe814", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:bf6a9125-76c7-58ea-9000-64bdd326de5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:fc1a41b3-1483-58c6-aeb5-5e029d884211", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:4991248d-f3b9-5048-ad2f-dcec7ea0d887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ac27aed6-47cb-5a4e-b59c-0e9f97175188", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:22a25678-bebe-5d9b-9ade-917c084eae81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:8e12870f-f5e4-51df-9822-f7a0104b9d2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:37b7f91f-537f-5020-8747-18a15201d78c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:03fc77cd-1f2d-51f0-9397-b0da3af1288c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:fd862021-607a-5dec-bed9-9c24fa6eddca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:e1f9f3a1-fa76-5093-bb7c-e477c6267d3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:83752f9e-1afd-5cca-bb0d-f412f1c93ab6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.0-tuxcare.7 of @angular/http. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable component (HttpTransferCache) does not exist in this version. According to patch documentation in the repository (CVE-2026-50170.patch, CVE-2026-54266.patch), the HTTP transfer-cache and client hydration features were introduced in Angular v16. Angular v7.2.0 predates this feature by many major versions. Exhaustive searches confir...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:a9d5c22c-8eb4-5ec2-81bd-6de06dc97fd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:15837e6a-e845-5ebc-920e-813542bcb911", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:57cd15bd-5bb3-5d8f-bfe7-acae58227ce6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.0-tuxcare.7 of @angular/http. not_affected \u2014 Angular version 7.2.0 is not affected by CVE-2026-88056. The vulnerability requires the presence of a `parseUrl` function in `packages/platform-server/src/url.ts` that uses `String.prototype.trim()` to normalize URLs, which strips Unicode whitespace and can convert validated same-origin relative URLs into cross-origin protocol-relative URLs. Version 7.2.0 does not contain the `url.ts` file; it ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:804d27b9-1430-5fb2-aa37-84f5738e2eb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:71e8ad78-fada-57da-9d50-bd9848e2086f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:c2c4450a-806c-58ee-bd61-116c1dbb1bbe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.0-tuxcare.7 of @angular/http. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, hierarchical HttpClient delegation (withRequestsMadeViaParent()), and automatic HTTP response caching features that were introduced in Angular v16+. Version 7.2.0 uses NgModule-based configuration (HttpClientModule) with manual TransferState only\u2014no automatic HTTP-to-TransferState caching exists. The...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ], "bom-ref": "urn:uuid:1f7faac9-b8e3-5f18-a052-d0c49bfd9fcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.0-tuxcare.7 of @angular/http." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/http@7.2.0-tuxcare.7" } ] }