{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b42acfdc-fabb-5308-8096-1b2ceecbc803", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2", "type": "library", "name": "@angular/core", "version": "15.0.3-tuxcare.2", "purl": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f04add91-3e6d-5c2c-bafc-034a1af47456", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cb7acd25-17f2-5cea-870f-ca43d05483db", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3278dc7a-96c9-5d95-81d2-42fe96e02266", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e9495f48-519f-53f2-a577-b7e1fc6cd4e3", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8e0e1f5c-935a-56a5-9d1e-0be15a280e4d", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:31a70119-f285-56fc-9068-19ad5fefc304", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d9bb28df-9b01-5963-8dca-a3242c2b34a4", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d03ca4e6-64e8-50d9-9ed8-fd357847debc", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:014f329f-505c-59cd-b5ca-791a1f2dcf53", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.0.3-tuxcare.2 of @angular/core. not_affected \u2014 Angular 15.0.3-tuxcare.1 is NOT affected by CVE-2026-50170. The HTTP TransferCache feature that is vulnerable in later Angular versions (v16+) does not exist in this version. The vulnerable code (transfer_cache.ts, hasAuthHeaders(), shouldCacheRequest(), withHttpTransferCache, provideClientHydration) is absent from Angular 15.0.3." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:58f842e2-855a-5f37-9573-908d3e02e2d7", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:73e9f297-5e5a-580e-9fb1-3c94c692a32e", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d7e6f3c6-8455-5f3f-9643-b51090bcb25a", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:550712ea-635a-5d9a-977a-34732d71fd9a", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:33d6d9f5-7747-5f1c-9906-ada95143e8a6", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:133657c7-4057-5d70-b561-b0dbadde100d", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4a539927-4862-5c1b-87fc-63b1bf3a4c9a", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1e80bf08-cdc7-54e4-b90e-3d2cb547a44f", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.0.3-tuxcare.2 of @angular/core. not_affected \u2014 Angular 15.0.3 is NOT AFFECTED by CVE-2026-54265. This version uses a different compiler architecture where two-way bindings desugar through the same code path as one-way bindings, both receiving identical security context resolution and sanitizer assignment. The vulnerable code (Ivy template pipeline with separate TwoWayProperty operation type) does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6439431c-4cda-58da-beae-c4ac47213bb5", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.0.3-tuxcare.2 of @angular/core. not_affected \u2014 Angular v15.0.3-tuxcare.1 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache keys does not exist in this version. This feature was introduced in Angular v16+. The target has no code path from HTTP request handling to the vulnerability's cache poisoning goal." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0d9ab231-59d5-52a7-90e5-224925ac2908", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:42851b8a-e081-5813-a75d-b80a7a29e1f9", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.0.3-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@15.0.3-tuxcare.2" } ] }