{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c470a90a-440c-5996-a304-d8a607c65009", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/http", "purl": "pkg:npm/%40angular/http@7.2.16-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1", "version": "7.2.16-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:34d9aceb-2a63-56bb-b4e4-861f185c973d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-4231 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.4." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4e7061ee-aa84-5b7c-8daa-a65e4eeb335b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:202b9f12-212e-5cc5-ac21-46ccc78507d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.4." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3e6b9212-e12d-554a-883a-4fe91e4612a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.3." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a1899600-e0b6-563f-8fc1-d42c5eef809f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a09ab7c4-230a-53c0-b123-3b0d60ac6ff7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:363c902c-bb63-5138-a182-661fabe44634", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ef513d58-0a4b-59b3-9160-df624e924aad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d8f84f46-82bd-5ca1-9e74-7582cf603ee8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b8d14772-7776-5ebb-a92a-29abc30a0471", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b0bf20e7-a069-573b-b680-906dde3b2774", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5d7dcd24-5d4a-5107-9ec3-57a7e88837fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8878c26e-f2a2-50a9-bf42-5f28ab1e470e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3c17301c-c7a5-593c-8d33-8007018ebf1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9c7d48e9-b845-5b6b-ab44-f61167cef4ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2352cb71-dbf4-5fea-8fc5-f0057541c462", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4311a4e7-d3d5-55d5-a6b6-af602d08f7f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:365b9e6c-6083-5cc2-ac3f-cee079144872", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a1b1d01f-f583-51fe-84ff-a84f82075148", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:33db8182-6865-5121-8ed1-36e1db2b54b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9c120364-8fdd-5a08-a90d-6af6c1c59d51", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.16-tuxcare.1 of @angular/http. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-68945. The vulnerability concerns HttpTransferCache's cache key generation logic that treats repeated HTTP parameters (`?role=user&role=admin`) and comma-separated values (`?role=user,admin`) as identical, causing cache key collisions. However, the HttpTransferCache feature does not exist in version 7.2.16\u2014it was introduced in Angular v16. While v7.2.1...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8e3921d1-69f9-5ef6-a790-0c84a2b790b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:98ed43ac-b3b2-5404-b515-cc4c281d832e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 7.2.16-tuxcare.1 of @angular/http, and is fixed in 7.2.16-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9cd90921-db91-5593-aaf7-4aa20ab95d46", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.16-tuxcare.1 of @angular/http. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88056. The vulnerability requires a String.prototype.trim() call on URLs during server-side rendering that strips Unicode whitespace characters, converting same-origin relative URLs into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 7.2.16. The CVE describes a vulnerability introduced in later Angular versi...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:64f2c65f-2080-59f4-9e1e-2c7d98c461d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88057 does not affect version 7.2.16-tuxcare.1 of @angular/http. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88057. The vulnerability exists in the Ivy compiler's template pipeline (introduced in Angular 9+), which does not exist in this version. Angular 7.2.16 uses View Engine, where the SecurityContext determination for directive host bindings correctly uses the concrete host element name (`element.name`) rather than the directive's selector. The exploitati...", "justification": "code_not_present" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b658de05-3031-5c01-8523-d424ca1db7a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.16-tuxcare.1 of @angular/http. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and client hydration features that were introduced in Angular v16+. Angular 7.2.16 predates these features by approximately 7 major versions. The codebase contains only legacy TransferState (manual key-value store) and NgModule-based HttpClient (no hierarchical delegation...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6a11a31a-aef6-517b-989f-26cba1400a58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 7.2.16-tuxcare.1 of @angular/http." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/http@7.2.16-tuxcare.1" } ] }