{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0af9dd08-1261-5c5e-81f7-3589110d320b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7", "version": "6.1.10-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:6a3faadf-722e-5d3a-93ba-c675c4074f3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 6.1.10-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:9d55d3b4-7070-581b-8db4-dffe9d93396f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:d4786822-bd64-5a8a-965a-a73159727e3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 6.1.10-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:626d36bf-6d10-5538-9fa8-c2788425c1b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 6.1.10-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:d5d59a06-776e-55d8-a381-2d13630e6ee2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 6.1.10-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:2c7865ed-99b7-5029-b3b6-229f2c3afcd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:333200a0-9afd-5006-82a2-8ca7742a354b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:272bd5e7-3eea-56df-a754-8e3ca2f646a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:1e5f079e-0fb4-5fb0-925b-ff59b7e32b6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:6b5b1653-7248-5912-8bd4-bef6194cc28b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:0c6132f7-8a35-59e6-b75a-f13419c26f93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:d56eebb2-9421-5c1d-a6a4-6f0278d3dd29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:975fd73f-c9fa-5b3c-9e76-9ede9b2d77c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:e118a778-d90c-5544-b638-867c62d905e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:086bf022-0729-5050-8759-f8148ed883d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:fd989d99-d178-5799-ab05-6f2cfb678d2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:684000ad-f543-5107-9dda-e2d61fa65e19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.8." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:f2d85bf3-f98d-5ed2-946a-3d46c7ff0f02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:b35fd7e1-3a4c-500c-9286-cfb9869a28a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:f4778d4b-d79b-5a52-b605-b01ee456300c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:b2ea9da2-64b2-50cf-ab93-88b14dc55074", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 6.1.10-tuxcare.7 of @angular/bazel. not_affected \u2014 Angular 6.1.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version \u2014 it was introduced in Angular 16.0.0 (April 2023), more than 5 years after Angular 6.1.10 (2018). The vulnerable file `packages/common/http/src/transfer_cache.ts` and all related APIs (`provideClientHydration`, `withNoHttpTransferCache`, `sortAndConcatParams`) are completel...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:3fe744b3-6edc-58df-9801-b169e70d83d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:4e07a847-481c-57f0-a6f3-82ee639ecd37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 6.1.10-tuxcare.7 of @angular/bazel, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:b634882b-b65f-50d0-9af8-ef44c3f548bb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.7 of @angular/bazel. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:f5ae6940-d885-534d-a810-a6905c9542d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 6.1.10-tuxcare.7 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:a24b0116-1955-5c96-ad8f-66c42c920e98", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 6.1.10-tuxcare.7 of @angular/bazel. not_affected \u2014 Angular 6.1.10 is not affected by CVE-2026-88059. The vulnerable HttpTransferCache feature, withRequestsMadeViaParent() delegation API, and modern hydration system (provideClientHydration()) do not exist in this version. These components were introduced in Angular 16+ (circa 2023), while the target version is from Angular 6 (2018). The vulnerability requires automatic HTTP response caching duri...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ], "bom-ref": "urn:uuid:cef7266a-6011-50ae-a022-705ad951ae56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 6.1.10-tuxcare.7 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@6.1.10-tuxcare.7" } ] }