{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b77b28fd-2940-518e-b0e1-622a651a1e92", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2", "type": "library", "name": "@angular/core", "version": "15.2.9-tuxcare.2", "purl": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:b700c36c-3cf7-577e-9bd0-73be0d5b9570", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:68bbedb1-902e-570c-b196-e33c9b6109e0", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c1da3a05-d350-5ba8-80d2-01f064812584", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:55d0bdda-3eb0-5264-a492-2fac3ec37f87", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7f882061-06ae-5abf-a90c-67724f5cb10b", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.2 of @angular/core. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8d7e54eb-bde2-5c33-b48c-f676805532e9", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e694bf5e-1ce7-5ec7-9872-ef5790512938", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:73cba5d3-3d5b-5ec2-8cee-6a5783f71d0d", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8e1f6b52-fef0-5d00-b9ef-414cf78ddc1b", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.2 of @angular/core. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:407d10a9-729b-5ac8-826c-48d82864813d", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ec26d2fb-5f35-51c6-9d51-4879ed634fb8", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4392a281-d625-5c05-afaa-0de637a6a4c6", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:073bf443-16e6-5672-96c3-9bf9d765f11f", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c577309e-f9ee-5500-bd66-63a639683442", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c2f60cb7-6922-5a06-81a0-0e2b3ed69520", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1d10c4ac-7a22-5c76-9e89-6f269d8e74e8", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:401cab25-316a-5a20-b7ba-7bb2ffcf7b78", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.2 of @angular/core. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b014b97b-b820-5b5c-be0d-8cd945be9a13", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.2 of @angular/core. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3a8a79f5-5371-5963-a975-107ca7873966", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8836b360-b11f-523d-9964-42bbc85345fb", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.9-tuxcare.2 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.2" } ] }