{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:89eedf29-6486-5536-a1d8-45ee55d8e5e7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2", "version": "5.2.11-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:a8402596-2133-5553-9827-6b1b8139c702", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-4231 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.4." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:b283d6c6-8267-53eb-b2f8-22f694886477", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.9." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:e6ab7be6-c3b7-5e69-9392-8234c646056d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.4." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:c5b5e057-d1a9-5489-b2a0-7bf363eacee0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.3." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:9c683f59-6c0f-5c02-b3cf-1f21f1021b2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:f815da6d-dc8a-51ec-9daa-14394033b10e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:8e15947d-a945-59ec-a7ac-96921c276ab5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:1d6d11bb-5b78-5188-9c9b-b26ee7609551", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:9737e267-2a53-53ee-927e-cb8a71ff1b8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:5f636573-f0ba-590f-b335-b20967ba621e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:4c344d4e-022f-5598-82cf-b85552dd6cd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:850e47bb-11fe-57af-8253-4ec22ec0aea1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:8f268e9f-53a5-5c7d-aedb-4c3d9b48b820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:d9062e77-bca8-50fc-8bc5-848e34a5f9d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:e1c8c759-1385-55f4-9051-37b945e68b88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:67db31c9-0cc4-5eef-a935-b9461741906c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:ebb8f2ab-257b-5af8-b394-ac1b3b154cf1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:4c5a4d86-14a3-5101-a775-aaf7cf27f05e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:36a5eea7-7938-53aa-9e08-7a6a73b3ad95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:4a5d5112-4f1c-51ba-bc07-2c5e2cbc97fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:97043a49-f667-5048-981b-4eaaa62da8a6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.2 of @angular/benchpress. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:fe9b3abb-6694-5cf7-a8ce-e740634fa64f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:ff6ff3d7-bb8d-5ba6-9a29-c1dc71d55a38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 5.2.11-tuxcare.2 of @angular/benchpress, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:6ebe0e02-adbf-5b74-9ad4-766591e2244f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.2 of @angular/benchpress. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:eb857434-8154-5b13-9c57-318eb983a3bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.2 of @angular/benchpress." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:ad7981ab-9102-5a21-9782-643b73d4ef56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.2 of @angular/benchpress. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ], "bom-ref": "urn:uuid:b04e2856-3544-5038-8a19-b804f95f1ca6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.2 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@5.2.11-tuxcare.2" } ] }