{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b51a0c71-c6e9-5ff8-973b-4c1ef9269319", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/animations", "purl": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3", "version": "6.1.10-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:1fc4d588-1da8-559e-ab2a-f03a5347add2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-4231 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.4." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:e218c31c-7edd-5675-ae70-3dd01c2a11a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:c32b7a19-0790-59bd-beab-8ffcd6aad316", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.4." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:c3e7cdb9-31e2-59eb-a406-3364adb4bf51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 6.1.10-tuxcare.3 of @angular/animations." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:b0b82604-cb98-564c-b4fd-b8fd38273b8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:3de8ea7d-c4a2-5d05-9ae8-fbc8d8149db8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:c918fd78-07cd-55ef-85db-4938b409a914", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:b3c8fc52-39f7-5909-9881-3578f2a105a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:71fe82ec-8faa-565e-a0cf-e8d2ad070321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:c844137f-0d00-5ae4-95ad-96e6527ace0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:e294bb4f-7929-5700-a3da-54d702eae782", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:10cbaef4-db31-5be8-bbd0-5a0c9ad5a7e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:3cfe8509-3b9a-554a-9fa6-9593dfba231c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:72e11892-570d-5233-aa5f-98e78f845a08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:3497ae6b-3e93-58b0-876c-71aa6baaeebd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:4c9ae7cc-f22f-58e9-bfb0-2e4c43bce8f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:d729ee6a-736f-56ce-b305-264c9df44917", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.8." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:7ba22f34-e444-5f7c-8cec-3a0bb07b263d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:3790050e-42fa-52d3-9140-6e1c90a166a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:6ba5e189-9663-5f79-99d5-55dd8820076a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:b427bc33-1602-5ac7-9f48-da393b6d2c62", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 6.1.10-tuxcare.3 of @angular/animations. not_affected \u2014 Angular 6.1.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version \u2014 it was introduced in Angular 16.0.0 (April 2023), more than 5 years after Angular 6.1.10 (2018). The vulnerable file `packages/common/http/src/transfer_cache.ts` and all related APIs (`provideClientHydration`, `withNoHttpTransferCache`, `sortAndConcatParams`) are completel...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:59dc063a-63e4-5143-95d9-657d40262fd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:3d8db2a2-fd83-5236-995c-ac5c2c7368cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 6.1.10-tuxcare.3 of @angular/animations, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:a0e0ba47-dc62-5012-9323-5cb711b9140d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.3 of @angular/animations. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:db3f4fcd-7ed5-5451-a863-6894c932b923", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 6.1.10-tuxcare.3 of @angular/animations." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:5f58f828-38d1-5aa7-aa5b-94aafff0dae2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 6.1.10-tuxcare.3 of @angular/animations. not_affected \u2014 Angular 6.1.10 is not affected by CVE-2026-88059. The vulnerable HttpTransferCache feature, withRequestsMadeViaParent() delegation API, and modern hydration system (provideClientHydration()) do not exist in this version. These components were introduced in Angular 16+ (circa 2023), while the target version is from Angular 6 (2018). The vulnerability requires automatic HTTP response caching duri...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ], "bom-ref": "urn:uuid:ca25c308-4c1c-5c27-a3c9-279952e9330c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 6.1.10-tuxcare.3 of @angular/animations." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/animations@6.1.10-tuxcare.3" } ] }