{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d54f9b72-25cc-5cee-a137-045a0ecb067d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@1.15.2-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/axios@1.15.2-tuxcare.2", "version": "1.15.2-tuxcare.2", "pedigree": { "ancestors": [ { "name": "axios", "purl": "pkg:npm/axios@1.15.2", "type": "library", "version": "1.15.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-10742", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:11ab831a-79f4-5cdf-aa32-d1d17787826d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10742 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:d6b48ac1-5844-5c07-9172-ee6af2b0559a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-28168 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:b5fb4c70-8fc7-5b95-b40a-67f5b72b6a27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3749 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:67a5d93a-5ecf-5380-a63a-c538cb2d9429", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45857 does not affect version 1.15.2-tuxcare.2 of axios. not_affected \u2014 Not affected. The target (axios 1.15.2-tuxcare.3) already contains the upstream CVE-2023-45857 fix, commit 96ee232 (author valentin.panov@me.com). That commit is in the upstream release before the first TuxCare commit. lib/helpers/resolveConfig.js only attaches the XSRF header when withXSRFToken === true or when withXSRFToken is unset and the URL is same-origin. A later upstream commit (1728aa1...", "justification": "code_not_present" } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:afd93b54-1eef-51a4-a9d0-d43c2350b9fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39338 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:8a987cf8-96be-533d-953b-17afb3fa68d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27152 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2025-54371", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:d60208fa-04e7-5a9a-b5e4-a21bd9dd2255", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 1.15.2-tuxcare.2." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:040780f7-74b6-5b0b-b8b8-4ee98ad2006b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58754 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:303127cb-4f9b-5f59-8699-199df442a2ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-62718 does not affect version 1.15.2-tuxcare.2 of axios. not_affected \u2014 axios 1.15.2 already contains the upstream fix for CVE-2025-62718 (upstream commit fb3befb6, PR #10661). lib/helpers/shouldBypassProxy.js strips trailing dots and IPv6 brackets from both the request host and the NO_PROXY entries before comparing them. The fix shipped in the upstream release that TuxCare onboarded, so the verdict is not_affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:395b85a7-8cb4-56a5-8705-b568ad63f85a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 1.15.2-tuxcare.2 of axios, and is fixed in 1.15.2-tuxcare.3." } }, { "id": "CVE-2026-101899", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:ca3319cc-1909-5da6-98e0-e59de2bcc5a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101899 is fixed in version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:36948b1e-cb6e-5b92-ae65-29f95968da98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101900 is fixed in version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:b5f8f10c-fd62-546b-9520-7a6ae49a30f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 1.15.2-tuxcare.2 of axios, and is fixed in 1.15.2-tuxcare.3." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:5247946f-cb75-54cb-9f22-83cdc8650930", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101902 is fixed in version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101903", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:94a34816-e519-524d-935e-1a15f03d8be8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101903 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:ceaa3a87-b553-5745-becd-dad85538ce1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101904 is fixed in version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101905", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:c1c144a4-436a-553d-9cd9-82cf28d0af86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101905 is fixed in version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101906", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:318039df-b74e-5969-88b4-23a9e4aeee25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101906 affects version 1.15.2-tuxcare.2 of axios, and is fixed in 1.15.2-tuxcare.3." } }, { "id": "CVE-2026-101907", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:69985596-8ef8-523a-a865-ac40346c2406", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101907 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:037475d1-7088-51b0-aad6-7a075d35f757", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101908 is fixed in version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101909", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:c73f4c22-2c8d-5f1c-b23f-bfd91dc4a117", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101909 affects version 1.15.2-tuxcare.2 of axios, and is fixed in 1.15.2-tuxcare.3." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:920935eb-9d66-5af6-b42c-833df218b3bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25639 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:0b27cb9d-9385-5477-a4e1-59754801df8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-39865 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:7c413047-3dcf-5080-975e-7149cfe900f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40175 does not affect version 1.15.2-tuxcare.2 of axios. not_affected \u2014 Target axios 1.15.2 already contains the upstream fix for CVE-2026-40175. Header values are sanitized in AxiosHeaders (CR/LF and other control characters stripped), and mergeConfig reads only own properties. The fix commit 163da722 was authored upstream (jasonsaayman@gmail.com) and shipped in the upstream release before the first TuxCare commit, so it is not a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:806c9f7e-d86c-5290-9cbb-a8d401558fcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42033 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:cf422116-522d-5ea2-9c8c-14c02c06d191", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42034 does not affect version 1.15.2-tuxcare.2 of axios. not_affected \u2014 Target axios 1.15.2 already contains the upstream fix for CVE-2026-42034 (upstream commit 1c7f6d76, \"enforce max body length when max redirects is 0\"). The streamed-upload path with maxRedirects===0 now pipes the body through a byte-counting Transform that errors once maxBodyLength is exceeded. The fix shipped in the upstream 1.15.2 release, before any TuxCare commit, so this is an upstream fix...", "justification": "code_not_present" } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:05d77b91-4377-5cd4-8106-d68051f58d8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42035 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:7014ebf0-5f48-556e-bd74-539fd1f6a4ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42036 does not affect version 1.15.2-tuxcare.2 of axios. not_affected \u2014 Axios 1.15.2 already contains the upstream fix for CVE-2026-42036 (upstream commit e8904af0, \"fix: stream response bypassed max content length\"). In lib/adapters/http.js, the responseType 'stream' branch now wraps the response stream in a byte-counting generator that throws AxiosError once maxContentLength is exceeded. The fix shipped in the upstream release, and the only TuxCare-side commits a...", "justification": "code_not_present" } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:47fe2220-d680-5204-9e64-e0a7cab03f74", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42037 does not affect version 1.15.2-tuxcare.2 of axios. not_affected \u2014 The target (axios 1.15.2) already contains the upstream fix. FormDataPart strips CR and LF from value.type before it goes into the per-part Content-Type header. The fix, upstream commit 75873270 \"fix: strip crlf correctly\", shipped in the 1.15.2 release that TuxCare onboarded, so this is an upstream fix and not a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:ae9e96ce-3d94-5dfa-bf0d-12a2fce8dfdb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42038 does not affect version 1.15.2-tuxcare.2 of axios. not_affected \u2014 Axios 1.15.2 already contains the loopback-equivalence fix for CVE-2026-42038. shouldBypassProxy() treats localhost, any 127.x.x.x address and the IPv6 loopback forms as equivalent when matching against no_proxy. The fix is upstream commit e033f243 (author jasonsaayman@gmail.com, committer noreply@github.com). It is part of the upstream 1.15.2 release, and HEAD has no TuxCare-domain commits.", "justification": "code_not_present" } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:43d5012e-c37b-51d3-a577-ce15d6b6f0da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42039 does not affect version 1.15.2-tuxcare.2 of axios. not_affected \u2014 The target (axios 1.15.2) already has the upstream depth-limit fix in lib/helpers/toFormData.js. The fix is upstream commit 85132ff (\"fix: form data recursion\", #10726), which is part of the 1.15.2 release. build() now takes a depth argument and throws AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED once depth exceeds maxDepth (default 100). The unbounded recursion no longer exists.", "justification": "code_not_present" } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:a7ce973c-e754-5765-bce5-4fde2a04e8db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42040 does not affect version 1.15.2-tuxcare.2 of axios. not_affected \u2014 The target (axios 1.15.2) already contains the upstream fix. The `'%00': '\\x00'` charMap entry and the `|%00` regex alternative are gone from lib/helpers/AxiosURLSearchParams.js. A NUL character therefore stays percent-encoded as `%00` in the serialized output. The fix, upstream commit 5266af94 (\"fix: improve regex in AxiosURLSearchParams (#10736)\"), shipped in the upstream 1.15.2 release.", "justification": "code_not_present" } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:8f937eaf-c1d0-5726-a7f1-69c9046ca839", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42041 does not affect version 1.15.2-tuxcare.2 of axios. not_affected \u2014 Axios 1.15.2 already contains the upstream fix (commit 42eb721e, \"replace in with has own prop util\"). mergeDirectKeys uses own-property checks instead of the `in` operator. The merged config is also a null-prototype object. The fix shipped in the upstream release, and HEAD has no TuxCare-domain commits, so this is an upstream fix.", "justification": "code_not_present" } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:085d74dd-ed31-581b-ad21-b8db7052b811", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42042 does not affect version 1.15.2-tuxcare.2 of axios. not_affected \u2014 axios 1.15.2 already contains the upstream fix for CVE-2026-42042. resolveConfig.js decides XSRF header forwarding with a strict check: `withXSRFToken === true || (withXSRFToken == null && isURLSameOrigin(url))`. The fix is upstream commit 1728aa1b, which is part of the upstream 1.15.2 release. Truthy non-boolean values such as 1, \"false\" or {} no longer skip the same-origin check.", "justification": "code_not_present" } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:bd32d010-eb9a-55f4-ab28-5a18177d6138", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42043 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:9074e0d2-4cb5-57eb-b8d6-cc31c0618b6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42044 does not affect version 1.15.2-tuxcare.2 of axios. not_affected \u2014 Target axios 1.15.2 already contains an upstream fix. The default transformResponse reads parseReviver through an own-property helper, so a polluted Object.prototype.parseReviver is ignored. The fix shipped in the upstream release, so the verdict is not_affected, not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:a477da85-edc2-5427-a4cf-d8fccae692dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42264 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:b34fe0ad-97b7-580b-a805-44fde852f17b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44486 is fixed in version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:4455299c-1c3c-5034-93cd-3b57e7dd779c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44487 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:6bf7c367-44a2-5703-b59e-db27ca243786", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44488 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44489", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:a445888f-5ba3-59bd-9578-11eb2db3d448", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44489 is fixed in version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:c6c5c1e1-d680-5a60-a54c-7afbfdaadd80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:5a116991-c683-5c2b-a14e-b476752ceaa2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44492 is fixed in version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:c9baa138-9491-56fa-b94f-bb48cb0a2978", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44494 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:8382ad86-ff21-5dd4-af4d-47c96b0803de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44495 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:bd9eff75-0387-5b03-9eeb-16bf7b6b9b1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:9fd55ed9-0d3a-54d8-8ccb-6aeae584fa69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67312 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:b98ede4c-e72d-595b-aaae-6f7509641476", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67313 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67314", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:ce4e9ceb-4b12-5f93-a403-a11f010569e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67314 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67315", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:5e93bfa5-558a-56d8-a276-33fa50daf82d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67315 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:70f832dc-82d1-50e9-a45f-b592f838d070", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67316 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:dac6be36-b26c-534a-9616-aa1074e92784", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67317 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:f96038de-af79-5aac-86c2-ff33baad53dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67318 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:0cdeaa9c-d200-5db2-8b60-b3304404bc7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67319 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67320", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:95f9f180-9f60-5b73-92c9-1a5c02039a4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67320 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67321", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:b8dbe8be-13df-5900-b7f4-e025d0c7d00e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67321 affects version 1.15.2-tuxcare.2 of axios." } }, { "id": "GHSA-38gx-cfqf-f652", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:83f34c8f-68eb-5cb5-a445-f93d7a91c301", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.15.2-tuxcare.2." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:bd6f02f0-cadc-54b3-97a9-640a56920b82", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.15.2-tuxcare.2." } }, { "id": "GHSA-3mcp-22mf-vrw3", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:87aaf875-230d-5066-8143-d5dd0f8d3b19", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.15.2-tuxcare.2." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:449bb6fc-48d5-50fb-b52d-ad4121d71d0b", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.15.2-tuxcare.2." } }, { "id": "GHSA-68jp-44vc-2x5h", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:4a030e81-d858-58e3-b725-f43355a6dc76", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.15.2-tuxcare.2." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:b005ed42-2697-5f3e-964d-7de5a1b59927", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.15.2-tuxcare.2." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:4db0af52-e9fc-5a6a-ba9a-e93df50f0f90", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.15.2-tuxcare.2." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:93d1f398-023d-5b6f-ae6b-86648b79c6cc", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.15.2-tuxcare.2." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:56b2e52f-8132-568b-afc0-5d9455d414db", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.15.2-tuxcare.2." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ], "bom-ref": "urn:uuid:f290c91a-6a84-5bbf-a98d-4e9b9e320170", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.15.2-tuxcare.2." } } ], "dependencies": [ { "ref": "pkg:npm/axios@1.15.2-tuxcare.2" } ] }