{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2d623897-713d-56e0-8394-3369d32bb16d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2", "type": "library", "name": "@angular/upgrade", "version": "15.2.2-tuxcare.2", "purl": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:b4a08cf9-1296-5092-98ab-f48c739ce489", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1b07eb80-ae12-55a5-9828-22391fc2ac49", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3b29ddee-0a8d-5bdb-82b8-a4e7c40e68e7", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f3760f2c-37ca-5176-90c9-228bf41314c4", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:18a8e1ee-53e9-5192-9604-f57749dfff74", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.2-tuxcare.2 of @angular/upgrade. not_affected \u2014 The target repository (Angular 15.2.2-tuxcare.1) is NOT affected by CVE-2026-41423. While the target lacks the specific fix from the upstream patch, it uses a fundamentally different URL parsing mechanism (Node.js legacy url.parse()) that does not exhibit the WHATWG URL specification behavior exploited in the vulnerability." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:01c446d9-3c10-55a4-8268-4d60d4a9a5cf", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:33cc36d3-cb0f-54d2-97cb-a86e0f612979", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2e64d164-d990-5659-b984-414a9426b442", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7a9f1830-e9b6-5c3d-8247-da845dc0a606", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.2-tuxcare.2 of @angular/upgrade. not_affected \u2014 Angular v15.2.2 is not affected by CVE-2026-50170. The HTTP TransferCache feature, which is the subject of the vulnerability, was introduced in Angular v16.0.0 (March 2023). The target repository version (15.2.2-tuxcare.1) predates this feature entirely and does not contain the vulnerable code path." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:035d88c1-7469-554e-963d-8f02de904b59", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5154f0d1-d8da-5e78-b9ed-3ac450cbb22b", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f170f81c-5b9a-58dc-a7cb-59801e2b4c4d", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a4306eab-060c-5f74-8ca5-9d631cd11e20", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cc4a576a-ebac-5344-8854-de9416d98420", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c6aabbc6-3fa4-5efc-8ad8-bdd72fb38516", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d8638fb9-2f24-5754-9552-336578808ea4", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:902c2ae8-5e71-56c0-b7d3-92128218b989", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.2-tuxcare.2 of @angular/upgrade. not_affected \u2014 Angular v15.2.2 does not contain the vulnerable code path. The CVE-2026-54265 vulnerability affects the template pipeline's resolve_sanitizers.ts (TwoWayProperty operation), which does not exist in v15.2.2. This version uses TemplateDefinitionBuilder where two-way bindings desugar to regular property bindings that receive identical sanitization as one-way bindings." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:883d675b-d25f-5ad9-aff0-944dc1da5da0", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.2-tuxcare.2 of @angular/upgrade. not_affected \u2014 Angular 15.2.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature was introduced in Angular 16.0.0 (May 2023), after this version was released (March 2023). The target codebase does not contain the transfer_cache.ts module, HttpTransferCache API, or any HTTP response caching mechanism that uses hash-based cache keys." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bc93e031-daae-55e1-8007-0c0f53ab0cee", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:260bf919-1158-5087-90e2-d832f445908a", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.2-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.2-tuxcare.2" } ] }