{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f262ac30-3cca-5109-aaf9-5eecb4eae16d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7", "version": "18.2.14-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:481e885d-a016-587c-a641-d705985255e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.2.14-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:74ce7155-fe87-5750-b094-85063cbc3b6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.2.14-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:c6175a8b-fefb-5c7d-a019-341daf2030c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.2.14-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:002b12ed-67e1-5a13-8876-a82a54f18c95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.2.14-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:a099b57b-cbb7-5e5b-a4c6-4dcdbc19e5a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.2.14-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:5100439c-9172-535f-84b7-325a322ad6e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.10." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:2c3358ab-aab4-5fcf-9f1b-18e9b9098fe6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.11." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:56ed616d-f769-595a-8232-0e7068f85d10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.11." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:745f9919-c9d7-5c06-9443-763b479c3ed5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.11." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:0ebf2e36-e894-54d8-b582-84bde53fef56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.11." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:6a4f21b8-c756-5b29-a082-1625ea196073", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.11." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:f008228f-fff2-503e-b4e2-c2ba02adfd2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.11." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:aa2818ce-d878-5b52-a50c-d752fe34220d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.11." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:7b86f369-6b9f-5908-9a75-02db7721f5d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.11." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:c1a554f6-f5e1-5d54-a682-87df014aee55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.11." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:c4cc9bbf-a344-5ad6-a004-f6f21331da0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.12." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:74b320cd-076d-5cd9-9650-f88104a1a2c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.12." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:8b10db11-aac9-5ebf-8ed0-6cb6ddabd93c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.12." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:2427c172-1b35-5383-8edc-4c550e2ef9e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.12." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:e91d11d3-9b20-5fe9-b11a-ffdab292edd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.12." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:e16c1c98-b018-5f46-97be-fbcf3341e108", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.13." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:9e747829-f782-5745-8b26-e3bd3eb87406", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.13." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:f465749c-62ba-5111-8bad-f032079c0777", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 18.2.14-tuxcare.7 of @angular/upgrade, and is fixed in 18.2.14-tuxcare.13." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:d7ac3141-4bdc-5f3b-a564-c44f6b64d354", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.2.14-tuxcare.7 of @angular/upgrade. not_affected \u2014 The target version 18.2.14-tuxcare.13 is NOT affected by CVE-2026-88056. The vulnerable code pattern (calling String.prototype.trim() on URL strings before resolution) was never present in this version. The target uses a refactored parseUrl() implementation introduced via commit 49a60f6045 (May 2026) that correctly handles Unicode whitespace by percent-encoding it rather than stripping it, main...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:dc2b7f0e-2821-5ad4-b2cd-4bd4c577ac43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 18.2.14-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:db6c0ccc-5699-5704-bc9a-7d68b04eeed4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 18.2.14-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:81a62164-b1cb-5514-95de-73969097bdaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 18.2.14-tuxcare.7 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.7" } ] }