{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2978021c-bd0f-5597-bc57-7a74096f149d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@6.1.10-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5", "version": "6.1.10-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:618987b7-9cb6-5a9c-915c-bf4ef1dffb2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 6.1.10-tuxcare.5 of @angular/common." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:52eabacb-719a-5bba-bb9b-9a7026c13b7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:27f578e4-0031-5d5a-b707-224e6382b874", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 6.1.10-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:aa0c7d3e-e348-5a4d-abb0-159b1b52fa09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 6.1.10-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:9d8218f9-6e25-5890-94fe-44089b7c16a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:688e51a8-2707-5e85-b1eb-d1356be976e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:83c04847-c3f8-5371-b6f3-d87cd223753d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:da575949-3797-5240-bdbe-d1bb0ca39d47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:13860df0-775f-5acb-ac69-91481c822f36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:90cb3a86-e40b-5136-91c7-8d08a19250cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:f4e8a4c9-80ca-53bb-be92-e797bd3c43c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:4b7f0a0a-80e9-5415-8c06-a2d2562e9d5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:ffc5f829-914a-52f3-97dd-ccd4dabe129a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:3ec88312-48d5-521a-bb11-f042089856db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:8b484a30-7cbb-5e7a-84e3-14c9d9d56d1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:c9740526-5571-56b6-9a13-a14fad5cab1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:676c1d15-03b6-598d-a64e-bb5f5ef51f13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.8." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:4454a4de-8933-5662-a85c-729535bf1aac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:0a35b10f-2d7b-570a-8d79-42661b0f996b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:8fb60d80-2b89-537f-bb8a-00d4ac0ac303", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:e930663a-e87e-5fe8-9d3f-b5d2ad8b1001", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 6.1.10-tuxcare.5 of @angular/common. not_affected \u2014 Angular 6.1.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version \u2014 it was introduced in Angular 16.0.0 (April 2023), more than 5 years after Angular 6.1.10 (2018). The vulnerable file `packages/common/http/src/transfer_cache.ts` and all related APIs (`provideClientHydration`, `withNoHttpTransferCache`, `sortAndConcatParams`) are completel...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:4314557a-2cfc-594f-a537-c5678d56dfe0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:1f53fdc1-385b-55ea-8f34-436769a51256", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 6.1.10-tuxcare.5 of @angular/common, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:d3c3def9-511d-5ff2-9fd6-95f623bdef3f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.5 of @angular/common. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:c25ada5e-585e-5cb8-82b2-99603be7b37a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 6.1.10-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:4d7a4ef2-5b1b-5b5e-8164-37e4c1696f4b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 6.1.10-tuxcare.5 of @angular/common. not_affected \u2014 Angular 6.1.10 is not affected by CVE-2026-88059. The vulnerable HttpTransferCache feature, withRequestsMadeViaParent() delegation API, and modern hydration system (provideClientHydration()) do not exist in this version. These components were introduced in Angular 16+ (circa 2023), while the target version is from Angular 6 (2018). The vulnerability requires automatic HTTP response caching duri...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:26c13633-5ac0-5fa3-8d17-fa4056d7dfa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 6.1.10-tuxcare.5 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@6.1.10-tuxcare.5" } ] }