{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0f4c562e-36e3-5d02-a3c0-c1c45199c746", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2", "version": "7.2.0-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:f5dd6497-0817-5937-a037-29e13ccc677c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:dc315c72-6934-58ad-8031-211717a44693", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:af761b3e-edab-5d11-a178-18643b5c37bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:32633e63-810d-511a-a3a2-43a9559cbc7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:11f7257e-1267-5a0f-90d2-320b3cd4c49a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:4e0c2437-6e48-5399-8ac6-3577c814109a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:49064082-a802-53f7-8ca2-1a806debfc6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:38243578-cf21-51cc-8e7c-5f1521b9d17c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:e9d70e2e-af75-5fdb-a335-67db97797d27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:8c0db9d2-106f-52a0-9e63-4867b823b5e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:3272c987-ad0c-5428-bd16-77659209d500", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:0b0df0ff-b6af-5c06-8930-4ce0668d76bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:00e36e5d-ea0e-5683-813b-7ef3a2b443b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:e7b9145d-847e-59bd-8140-44c5fe2c89df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:84adf406-45a1-530d-9c5b-6a2bbbcfaafa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:28cc4ece-d6df-51ce-b3bf-abf9b3dd4ec6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:bb6ae12e-1134-5b71-a20e-8463468d0433", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:22f79d74-1865-544d-8767-462cbf5b7512", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:2d1a4cad-7830-5c0f-88cf-f3fbc8a13f99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:4eb2216a-6234-5581-9b76-1796cfa496f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:17502162-230e-5243-a5fb-0a9511a22a8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:7be5ef8f-225a-51c9-8774-ea1ed79f0689", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.0-tuxcare.2 of @angular/upgrade. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable component (HttpTransferCache) does not exist in this version. According to patch documentation in the repository (CVE-2026-50170.patch, CVE-2026-54266.patch), the HTTP transfer-cache and client hydration features were introduced in Angular v16. Angular v7.2.0 predates this feature by many major versions. Exhaustive searches confir...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:365570b6-50c4-56ce-b068-c61c1b83affc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 7.2.0-tuxcare.2 of @angular/upgrade, and is fixed in 7.2.0-tuxcare.3." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:a8aa1d65-4839-52cd-9188-6b0b778595fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 7.2.0-tuxcare.2 of @angular/upgrade, and is fixed in 7.2.0-tuxcare.3." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:aac69fb2-8017-5ef8-b41c-3ad1609bfe64", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.0-tuxcare.2 of @angular/upgrade. not_affected \u2014 Angular version 7.2.0 is not affected by CVE-2026-88056. The vulnerability requires the presence of a `parseUrl` function in `packages/platform-server/src/url.ts` that uses `String.prototype.trim()` to normalize URLs, which strips Unicode whitespace and can convert validated same-origin relative URLs into cross-origin protocol-relative URLs. Version 7.2.0 does not contain the `url.ts` file; it ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:83202e6e-b25e-5032-a87e-6a79c0a6dc0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 7.2.0-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:a99fa462-5437-5d60-af81-4dc014b6280a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.0-tuxcare.2 of @angular/upgrade. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, hierarchical HttpClient delegation (withRequestsMadeViaParent()), and automatic HTTP response caching features that were introduced in Angular v16+. Version 7.2.0 uses NgModule-based configuration (HttpClientModule) with manual TransferState only\u2014no automatic HTTP-to-TransferState caching exists. The...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ], "bom-ref": "urn:uuid:ed20ad90-ddbd-53ec-8b5c-ad6204e661af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 7.2.0-tuxcare.2 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@7.2.0-tuxcare.2" } ] }