{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:344ff7fc-7b6a-54db-8550-39c87208cf60", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/next@14.2.35-tuxcare.2", "type": "library", "name": "next", "version": "14.2.35-tuxcare.2", "purl": "pkg:npm/next@14.2.35-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0f96567c-283a-5d67-ad45-9a39feedb44c", "id": "AIKIDO-2026-10095", "analysis": { "state": "exploitable", "detail": "Vulnerability AIKIDO-2026-10095 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8d4a6917-c9ce-5199-8263-4d7dcb11bc15", "id": "AIKIDO-2026-10755", "analysis": { "state": "exploitable", "detail": "Vulnerability AIKIDO-2026-10755 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f615d540-2c64-502f-8eb1-02eceeb9f88c", "id": "AIKIDO-2026-10757", "analysis": { "state": "exploitable", "detail": "Vulnerability AIKIDO-2026-10757 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8172659e-f5fb-5376-a23f-f7b5c431d4f1", "id": "AIKIDO-2026-10758", "analysis": { "state": "exploitable", "detail": "Vulnerability AIKIDO-2026-10758 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:088562cc-ace6-5094-b6e3-cb67d9c3141d", "id": "AIKIDO-2026-10762", "analysis": { "state": "exploitable", "detail": "Vulnerability AIKIDO-2026-10762 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6e84b427-10f0-59b6-a218-b49fe552174b", "id": "CVE-2025-55173", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55173 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b5e38a52-c466-5c9d-a0aa-c3e11ecae949", "id": "CVE-2025-57752", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-57752 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8fc3b81a-34c9-5907-95f5-252e5e98a13e", "id": "CVE-2025-59471", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59471 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:801af52b-e9ef-5dbe-8464-235d301ba3f7", "id": "CVE-2025-59472", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59472 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bdf6541f-e5e0-5d5f-ae06-9abf733699f3", "id": "CVE-2026-27980", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27980 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:796168ca-ee9d-57e0-9d9b-91f136b361a8", "id": "CVE-2026-29057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29057 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d3db14d9-a008-5535-8a9e-968214ae7401", "id": "CVE-2026-44572", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44572 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8d09fa6e-40c3-512e-b872-57bd16a46deb", "id": "CVE-2026-44573", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44573 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:71fa8c89-aa86-5709-a4bc-4c5e2bf80005", "id": "CVE-2026-44576", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44576 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2b73fd5d-0714-5364-afb0-6706763dff4b", "id": "CVE-2026-44577", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44577 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cfac857b-67aa-5964-8280-67817158998c", "id": "CVE-2026-44578", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44578 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1887f9e1-9da8-5073-9e8f-28944d7d27c7", "id": "CVE-2026-44580", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44580 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:20e42195-97aa-5e37-99c8-129ffe848c43", "id": "CVE-2026-44581", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44581 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:25feb328-8c0f-50cc-80f7-9bead3782a5e", "id": "CVE-2026-44582", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44582 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3c87dc85-32a3-541c-bf31-e1536412e5b5", "id": "CVE-2026-64641", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64641 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2be4631e-0ee5-560b-856e-3c496300bea7", "id": "CVE-2026-64643", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64643 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fa58aa8f-b023-5174-becb-dfb43f6b8734", "id": "CVE-2026-64645", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64645 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:db31a4a7-c800-5dd9-8ad9-7c34b9d8f35f", "id": "CVE-2026-64646", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64646 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:813fcb8e-7dba-5c7f-8fa7-31dc924b5ea6", "id": "CVE-2026-64647", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64647 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:54ba3f0d-c99a-5bfa-ad13-e0eadcb5b6ec", "id": "CVE-2026-64648", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-64648 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a609d7d4-334f-5634-bcb1-56704e152c1d", "id": "CVE-2026-64649", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-64649 does not affect version 14.2.35-tuxcare.2 of next. not_affected \u2014 Target version 14.2.35 is not affected by CVE-2026-64649. The upstream vendor (Vercel/Next.js) introduced the __NEXT_PRIVATE_ORIGIN protection mechanism in version 14.2.0, which is present in this target. When using the framework's standard production mode (next start), this environment variable is automatically set, preventing the SSRF vulnerability by using a predefined origin instead of untr..." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5c0d76e2-eb2e-566f-bc38-a12981f24840", "id": "GHSA-8h8q-6873-q5fj", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-8h8q-6873-q5fj affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1469a62e-49fb-567a-b055-a45f35c73c96", "id": "GHSA-h25m-26qc-wcjf", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-h25m-26qc-wcjf affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2b59050d-4846-56be-97e3-49eb1aec948f", "id": "GHSA-q4gf-8mx6-v5v3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-q4gf-8mx6-v5v3 affects version 14.2.35-tuxcare.2 of next." }, "affects": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/next@14.2.35-tuxcare.2" } ] }