{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cbaee139-e885-55cc-9f21-1f3a81f082e3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1", "version": "6.1.10-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:e24d1821-f3d1-5ddb-97ff-d63abb0664ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-4231 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.4." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:8052bca2-21aa-5414-a948-22939450be8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:da836acf-73a1-5893-bb0e-a7c2110b6a2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.4." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:dcd30efe-20a5-555c-b6e9-6977771b9822", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.3." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:a4d45a58-0728-5a66-98b4-fcde4973602b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:e9218f60-0f09-5b64-a90d-794d11b37fc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:c3d93813-7868-5d7c-91ae-f891c734d5ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:a1383af8-e909-57ea-a0f4-3e7c3fbc05ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:81cf3888-1496-5ad8-a71c-004840d8f774", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:54eb3553-84de-5243-b49a-f9a72708800c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:157e0fc8-2dd5-5d95-9b68-1daee7373eef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:ca42d25e-36a2-5c3b-b564-bcfc0d5f2418", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:0fb77f7d-470a-53ce-8022-ff341db4f2de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:903141c0-84e0-5acb-a22e-5bab17d8c40a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:c76e28b5-bc06-5db9-bc01-dd06a0ed0594", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:570d16c3-00b5-53a9-9f0b-dab2b993398c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:0a915f32-7dc9-5040-8d5e-fc2cbdf2cf08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.8." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:0a32ff42-5b09-5fec-b292-194b400e6a58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:a3051226-1617-58f2-8b7e-eaa641cbafd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:da8c1d4d-5971-52cf-8db3-6d74b76f715a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:50c9a8e8-a81d-5138-9f98-fab912202342", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 6.1.10-tuxcare.1 of @angular/upgrade. not_affected \u2014 Angular 6.1.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version \u2014 it was introduced in Angular 16.0.0 (April 2023), more than 5 years after Angular 6.1.10 (2018). The vulnerable file `packages/common/http/src/transfer_cache.ts` and all related APIs (`provideClientHydration`, `withNoHttpTransferCache`, `sortAndConcatParams`) are completel...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:11e12c46-8d0b-56ee-86cb-21f6cd42b833", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:2debee6d-b979-5085-a64f-4a3b710bfae0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 6.1.10-tuxcare.1 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:9a0260fa-66bd-5abc-acb4-a7c95c716cc0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.1 of @angular/upgrade. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:0d042201-b527-576f-b8d5-e75637f19a35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 6.1.10-tuxcare.1 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:c2580a71-823d-5d91-8ce0-d4be22d7835f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 6.1.10-tuxcare.1 of @angular/upgrade. not_affected \u2014 Angular 6.1.10 is not affected by CVE-2026-88059. The vulnerable HttpTransferCache feature, withRequestsMadeViaParent() delegation API, and modern hydration system (provideClientHydration()) do not exist in this version. These components were introduced in Angular 16+ (circa 2023), while the target version is from Angular 6 (2018). The vulnerability requires automatic HTTP response caching duri...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ], "bom-ref": "urn:uuid:d8161ddb-eac9-5cd1-8559-a28344a18ff4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 6.1.10-tuxcare.1 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.1" } ] }