{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:526a1023-e5d7-5334-aa44-8af4ca6e052f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14", "version": "18.2.14-tuxcare.14", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:e752b314-885f-502f-9da5-7201aa5f9cd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:bb00ac62-7ee0-5b74-b193-c64def6de4f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:80d94bf5-8f74-5d83-b55d-5da37255f36a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:6983a80c-d164-59c4-8fd9-9ff634e78fd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:951387bb-34cb-5cb0-af5c-26ac4979c6c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:0af1d009-7b04-5f48-b722-cb90500c161e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:7aa64af1-aca1-5f8f-bc60-b1c10237633b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:883df7ff-1a8d-5580-8771-9a7a7f92516e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:a173a74b-3ff5-54fa-9c3b-f3f24a6a6399", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:0a47c3a6-732f-5d6a-9470-741b0dad7e51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:46d675bc-54d4-54f7-a351-85b9d3837ea2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:106b1979-dd89-5a72-8417-db5f5f49991e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:46f45489-16c8-5bed-8c93-a9955e0af35a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:69483616-0b96-569f-b763-5ea7debf2675", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:08382bb6-b560-5bb0-b1f9-c15060565dde", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:11caa1e2-74a6-5c6a-b8ae-e788de9102f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:280f8385-42b2-5ba4-9ccc-8e59bb30f6f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:dc2cf0d3-49ed-55e4-a507-f490b539f636", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:e8df59a7-1d50-55bc-949e-2a370bfd074d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:f36680b8-fd7c-5c88-9797-d988eac42d94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:8053a386-bd47-5282-baa5-2b9b9fcc64c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:127a6809-ca10-5f8b-bc6d-f3bed2d506da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:aec9fcce-8ebe-50f7-861e-ade1271484a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:22c58e20-6790-5952-a525-f8fdf23b409a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.2.14-tuxcare.14 of @angular/upgrade. not_affected \u2014 The target version 18.2.14-tuxcare.13 is NOT affected by CVE-2026-88056. The vulnerable code pattern (calling String.prototype.trim() on URL strings before resolution) was never present in this version. The target uses a refactored parseUrl() implementation introduced via commit 49a60f6045 (May 2026) that correctly handles Unicode whitespace by percent-encoding it rather than stripping it, main...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:a59a756f-6c40-5d0b-9859-e44a7317914c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:80fb50d4-8760-53f9-9997-f756974210d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 18.2.14-tuxcare.14 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:91696712-0717-5f68-83bf-e76119c9272d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 18.2.14-tuxcare.14 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@18.2.14-tuxcare.14" } ] }