{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dad229f6-2475-5c58-b547-8eddf08dff09", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2", "type": "library", "name": "@angular/core", "version": "13.3.12-tuxcare.2", "purl": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c267ca64-fe28-5fb4-b575-21d189082fc7", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e9e1e015-f572-5f0d-9eeb-651e07463eb2", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:aca947bf-258a-5e8c-b9fc-65120b912909", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:967ae33e-e9f2-5617-946e-7fa6bb9f7a13", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:94662194-57c1-5d4a-ba9c-c1f92e950e91", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:68c2fb8d-66c5-5f49-b98a-8e42c75662fb", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:183cf789-507a-5c68-8ce9-103ead1c013c", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9c6c775b-789d-552c-a5fd-ff26c9e51265", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fc556edc-156b-5086-9be6-8fba73753154", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 13.3.12-tuxcare.2 of @angular/core. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-50170. The HttpTransferCache feature that contains the vulnerability was introduced in Angular v16.0.0 (March 2023) and does not exist in this earlier version." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e7d45ff6-d6b7-5027-8445-97752038d785", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ea3ed462-515c-5ccf-b44b-3f1561522a18", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e380ce01-bf7c-56ed-9b7e-0e5b7e15cfcc", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dd597a16-a4fe-5a5e-833d-485b12328343", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a2606a08-bfb8-5075-8e77-f46989a97523", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c44f600b-4300-5261-a603-058d669692b7", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:455345c7-ace2-5384-ad59-ee270e9e4917", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 13.3.12-tuxcare.2 of @angular/core. not_affected \u2014 Version 13.3.12 does not have the vulnerable code pattern. The vulnerability exists in versions 20.x+ where the Service Worker's newRequestWithMetadata function preserves request headers but fails to strip sensitive headers on cross-origin redirects. Version 13.3.12 lacks this function entirely and creates fresh requests with URL-only when handling redirects, preventing header leakage." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c167179a-83be-57a7-9c13-f52fa515f253", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 13.3.12-tuxcare.2 of @angular/core. not_affected \u2014 Angular v13.3.12-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability is specific to the Ivy template pipeline architecture (TwoWayProperty operation) introduced in Angular v17+. This version uses an older Ivy architecture where two-way bindings desugar through the same sanitized property binding path as one-way bindings, preventing the sanitization bypass." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d8583502-e491-504c-bab5-e09467cdf5c9", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 13.3.12-tuxcare.2 of @angular/core. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation was introduced in Angular v16.0.0-next.7 (March 2023), which is 3+ major versions newer than this target version. Exhaustive code analysis confirms the transfer_cache.ts module, HttpTransferCache class, generateHash function, and all related cache key gener..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:181351fb-f230-5d14-8e51-8be3ed242f6a", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:96f66a1b-8090-5ca2-9033-997c5ee061a2", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 13.3.12-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@13.3.12-tuxcare.2" } ] }