{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:12b27be1-fc1e-5976-bad6-b716ba1858bf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5", "version": "6.1.10-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:6a43660b-897f-5ff6-a5ae-259a2107022b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 6.1.10-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:d10d3b36-9367-5387-a269-5fe7adc623d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:f97b0f8b-a4fa-59f4-b8e3-8f02b58a005f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 6.1.10-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:bfe4d8db-9f08-5e2d-a02e-156a58157f30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 6.1.10-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:837777f3-cc79-5b42-8883-5d80d9145ff4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:a88f2eff-794d-5a6a-8ea2-eff4d0b0d39b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:dba3c735-7056-5c5b-a8cf-d7eff20fa9fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:95452703-f7c6-58c9-abcd-792b488e67ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:c9ffec2c-73b7-51ac-8ddd-79845b0d3269", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:ea9372c7-c5f5-5e33-b15a-c5e8efddf2dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:07d1f6fc-1797-5043-b0f9-db0688ca746d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:ef571e91-a955-5976-889f-dc9cca29c0f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:365b58e9-034b-54c3-8035-28f2a589fbae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:08da8331-fd99-50d7-b3d2-187056de3974", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:3c575f29-d69f-5b4a-be02-558aee199347", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:dc8ebd98-6300-5603-9d7a-c94b99d0fc24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:c5bcffc5-cb9c-5d1a-a0bc-d9709090d0b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.8." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:8c4f2557-26be-5bfb-bdee-047f74200d70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:073800fb-1402-5f2e-bbe6-ca3fa0a1e025", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:cf93cfc0-4396-5d0a-8a17-ca8d095284e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:dfc6b665-b73d-5594-9405-bd8d020a18d4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 6.1.10-tuxcare.5 of @angular/upgrade. not_affected \u2014 Angular 6.1.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version \u2014 it was introduced in Angular 16.0.0 (April 2023), more than 5 years after Angular 6.1.10 (2018). The vulnerable file `packages/common/http/src/transfer_cache.ts` and all related APIs (`provideClientHydration`, `withNoHttpTransferCache`, `sortAndConcatParams`) are completel...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:2807cb97-35b4-5c67-91fb-ea58bf9ef511", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:efe9776b-2ab7-5a1f-b0d4-65fb9f95f23d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 6.1.10-tuxcare.5 of @angular/upgrade, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:faebdfb9-66af-51ea-9830-5d359a5f6f06", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.5 of @angular/upgrade. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:9bc959f5-2d91-55eb-9b13-ba8c90f5a9a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 6.1.10-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:4047f9b4-b75e-5e09-8492-3a22b6075fda", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 6.1.10-tuxcare.5 of @angular/upgrade. not_affected \u2014 Angular 6.1.10 is not affected by CVE-2026-88059. The vulnerable HttpTransferCache feature, withRequestsMadeViaParent() delegation API, and modern hydration system (provideClientHydration()) do not exist in this version. These components were introduced in Angular 16+ (circa 2023), while the target version is from Angular 6 (2018). The vulnerability requires automatic HTTP response caching duri...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:04dc8a57-7b6e-5b21-821f-00b65eb8771b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 6.1.10-tuxcare.5 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@6.1.10-tuxcare.5" } ] }